@sema-agent/server 7.76.2 → 7.78.0

package/dist/boot/runner-deps.js

@@ -156,7 +156,9 @@ export function createRunnerDeps(ctx) {
         onElicit: elicitation ? elicitation.elicit : undefined,
         onQuestion: question ? question.question : undefined,
         onAsk: createRunnerDepsOnAsk(toolApproval),
-        autoMode: {},
+        autoMode: {
+            ...(config.autoModeClassifierFallback !== undefined ? { classifierFallback: config.autoModeClassifierFallback } : {}),
+        },
         sessionStore,
         memoryBackend: memoryEngine ? memoryEngine.backend : undefined,
         memoryEngineDir: memoryEngine ? memoryEngine.root : undefined,

package/dist/config-catalog.js

@@ -73,6 +73,7 @@ export const CONFIG_CATALOG = [
     r("AUTH_BRIDGE_ISSUER", "auth", "string", "registry SSO-JWT issuer(auth bridge 的开关之一)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 用 configCenter.baseUrl(配了 center 即默认开桥)" }),
     r("AUTH_BRIDGE_JWKS_URL", "auth", "url", "registry SSO-JWT 的 JWKS 地址(缺省从 issuer 派生)", { danger: SEC }),
     r("AUTONOMY", "auth", "enum", "运维 autonomy 模式,tighten-only 叠到每个 TaskSpec(read-only/plan ⇒ 只读手,ask ⇒ 恒 shellGate);center 腿热且 non-sticky", { danger: SEC, enumValues: ["read-only", "ask", "plan", "auto"], configKey: "autonomy", center: cGov("autonomy") }),
+    r("AUTO_MODE_CLASSIFIER_FALLBACK", "approval", "enum", "auto 分类器席答不出裁决时的梯子(main=主模型代判 / none=只留分类器那一级,整条拒)", { enumValues: ["main", "none"], danger: SEC, derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随引擎缺省 main(core 7.18.0 起;空串按未设,与其余词表旋钮同判);none = 7.77.0 及以前的行为逐字;词表外的值启动期拒启。权限轴放宽,升级须知见 DEPLOY-PREREQS", configKey: "autoModeClassifierFallback" }),
     r("BAKE_CACHE_BASE", "orchestration", "url", "烤镜像 fetch-once 缓存源 base(注入 --cache-base;绝不受调用方控制)"),
     r("BAKE_IMAGE_REGISTRY", "orchestration", "string", "烤镜像自动登记的 registry host 前缀(repo=registry/profile)"),
     r("BAKE_LEASE_MS", "orchestration", "number", "bake 租约窗(ms;runner 心跳推进,过期被 reaper 抢)", { staticDefault: "90000" }),

package/dist/config-center/read-warnings.d.ts

@@ -9,12 +9,21 @@
  *
  * 截断:schema 的键列表有界(64),超界带 `truncatedFrom`(真实总数)——文案如实带上,消费方永远不把有界列表当穷举。
  * 词表是闭集:`switch` 穷举 `kind`,schema 加新 kind 这里编译红,不会静默漏臂。
+ *
+ * **归族只有一条判据**(下游只有一个消费者——候选门:非空 ⇒ 这棵树整拒、保 LKG):
+ * 运维**写了而没生效**的 ⇒ 候选门错误;值**已被收编接受**(写了、生效了、只是换了个位置或被夹住)⇒ 不入诊断面。
+ * settings-schema 2.0.0 的两员新告警各自入族,没有新开第三档:`entry-dropped`(逐条容错丢掉的那条条目——
+ * 运维写下的模型/服务器没进目录,与 `domain-defaulted` 是同一件事的细/粗两档)归前者;
+ * `legacy-governance-lifted`(0.5 期 runtime 文档里的治理三闸被抬进 governance 域)归后者——那几个键**生效了**
+ * (`buildEffective` 用抬升结果解析 governance),把它折成错误会让一份合法的 0.5 期存量配置每一次 refresh 都被
+ * 候选门整拒,而它在 1.10.0 上零告警零 domainErrors(亲验读数)。兼容臂的关窗观测归属主(settings-schema 的
+ * `onWarning` 流),不借候选门这条带副作用的通道传信息。
  */
 import type { EffectiveReadWarning } from "@sema-agent/settings-schema";
 export type FoldedReadWarning = {
     readonly domain: string;
     readonly error: string;
 };
-/** null = 不入诊断面(`hosts-grandfathered`:值已被收编接受,与本地店同口径)。 */
+/** null = 不入诊断面(`hosts-grandfathered` / `legacy-governance-lifted`:值已被收编接受,与本地店同口径)。 */
 export declare function foldEffectiveReadWarning(w: EffectiveReadWarning): FoldedReadWarning | null;
 //# sourceMappingURL=read-warnings.d.ts.map

package/dist/config-center/read-warnings.js

@@ -1,5 +1,6 @@
 const MAX_ERROR_CHARS = 600;
 const cap = (s) => s.slice(0, MAX_ERROR_CHARS);
+const errorText = (e) => (e instanceof Error ? e.message : String(e));
 const keyList = (prefix, keys, truncatedFrom) => {
     const total = truncatedFrom ?? keys.length;
     const budget = MAX_ERROR_CHARS - prefix.length;
@@ -18,9 +19,12 @@ const keyList = (prefix, keys, truncatedFrom) => {
 export function foldEffectiveReadWarning(w) {
     switch (w.kind) {
         case "hosts-grandfathered":
+        case "legacy-governance-lifted":
             return null;
         case "domain-defaulted":
-            return { domain: w.domain, error: cap(w.error instanceof Error ? w.error.message : String(w.error)) };
+            return { domain: w.domain, error: cap(errorText(w.error)) };
+        case "entry-dropped":
+            return { domain: w.domain, error: cap(`entry dropped by domain schema: ${w.path} (${errorText(w.error)})`) };
         case "unknown-keys-dropped":
             return { domain: w.domain, error: keyList("unknown keys dropped by domain schema: ", w.keys, w.truncatedFrom) };
         case "unknown-keys-carried":

package/dist/config-provider.js

@@ -2,7 +2,7 @@ import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
 import { foldEffectiveReadWarning } from "./config-center/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
-import { findSkillContent, skillContentHash, refIntegrityIssues, siblingResolver, } from "@sema-agent/settings-schema";
+import { findSkillContent, skillContentHash, refIntegrityIssues, createSiblingResolver, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, ConfigCenterHttpError, } from "./config-center/facade.js";
 import { createLogger } from "./observability/logger.js";
@@ -74,7 +74,7 @@ export class LocalConfigProvider {
         if (etag !== undefined && etag === tag)
             return null;
         const refErrors = [];
-        const resolve = siblingResolver(store, eff);
+        const resolve = createSiblingResolver(store, eff);
         for (const d of ["rosters", "workers", "models", "collab", "systems", "entitlement"]) {
             const issues = await refIntegrityIssues(d, eff[d], resolve);
             if (issues.length > 0)

package/dist/config-types.d.ts

@@ -1440,6 +1440,18 @@ export interface ServiceConfigFlat {
      *  「缺席=不阻」⇒ 壳发 `permissionMode:"auto"` 即武装)。词表外的值 boot 拒启(安全轴旋钮不许静默回默认)。
      *  合成点 = `boot/runtime-caps.ts` 最外层(applyLocalAutoModeDeny);读面 = `/v1/capabilities.permissionModeAuto`。 */
     permissionsDisableAutoMode: boolean;
+    /** 7.78.0(core 7.18.0 [ref])—— **分类器席答不出话时怎么办**(`AUTO_MODE_CLASSIFIER_FALLBACK`,
+     *  部署级旋钮,闭二词 `main` | `none`,词表外的值 boot 拒启)。
+     *
+     *  为什么这一格必须由部署说了算:core 7.18.0 把**缺省**从「分类器跑不出裁决 ⇒ 这一次门控调用整条拒」
+     *  改成「主模型代判」(`main`)。auto 模式里的分类器是一道**筛子**,而 `main` 让**被筛的那只模型**
+     *  兼任筛子 —— 这是权限轴上的一次放宽,愿不愿意接受它是部署的事,不是引擎的事。`none` = 只留分类器
+     *  那一级梯子 = **7.77.0 及以前的行为逐字**。
+     *
+     *  🔴 **缺席 = 不铸键**(与 `readFace` 族同律,不复制上游缺省):上游改缺省之日起本仓不会成为第二份
+     *  真源。所以缺席时这台机器跟随 core 的 `main`,运维面由 DEPLOY-PREREQS 的升级段点名(「默认变了」
+     *  是升级须知,不是一个可以静默过去的实现细节)。 */
+    autoModeClassifierFallback?: "main" | "none";
     /** S-111([ref] §4.4)—— CC `settings.crossSessionInbound` 的**部署/组织层**(引擎层形的 `managed` 层,
      *  CC `policySettings` 对位):本部署对入站跨会话消息的治理三态。`accept` 投递 / `hold` 停在收件会话的待审
      *  队列 / `refuse` 整体退出车道。**未设 = 本层不设**(不是 accept):引擎读作「managed 层未表态」,由其余层
@@ -1814,7 +1826,7 @@ export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "ses
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
-export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "crossSessionInbound" | "crossSessionDialogExpiry">;
+export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "crossSessionInbound" | "crossSessionDialogExpiry">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析

package/dist/config.js

@@ -1162,6 +1162,7 @@ function parseApprovalDomain(ctx) {
                 `Refusing to boot rather than treating a misspelled value as "unset": that silently ran the deployment with NO shell gate while the operator believed one was configured`);
         })(process.env.MANUAL_MODE_SHELL_GATE),
         permissionsDisableAutoMode: boolEnv("PERMISSIONS_DISABLE_AUTO_MODE", false),
+        ...optionalEnumKey("autoModeClassifierFallback", "AUTO_MODE_CLASSIFIER_FALLBACK", process.env.AUTO_MODE_CLASSIFIER_FALLBACK, ["main", "none"]),
         ...optionalEnumKey("crossSessionInbound", "CROSS_SESSION_INBOUND", process.env.CROSS_SESSION_INBOUND, CROSS_SESSION_INBOUND_SETTINGS),
         ...optionalEnumKey("crossSessionDialogExpiry", "CROSS_SESSION_DIALOG_EXPIRY", process.env.CROSS_SESSION_DIALOG_EXPIRY, CROSS_SESSION_DIALOG_EXPIRY_VALUES),
         mcpElicitation: {
@@ -1993,7 +1994,7 @@ const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
     "approvalHmacKeys", "durableApproval", "durableApprovalSource", "streamAskWindowMsSource", "directApprovalDoor", "directDoorActive", "resourceSuspend",
     "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
-    "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "crossSessionInbound", "crossSessionDialogExpiry",
+    "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "autoModeClassifierFallback", "crossSessionInbound", "crossSessionDialogExpiry",
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",

package/dist/fleet/subagent-tail-bus.d.ts

@@ -7,7 +7,9 @@ export type SubagentTailFrame = Record<string, unknown> & {
     type: string;
 };
 /** core forward 事件 → wire 投影(sync 主流五分支同源;不认识的帧类型=null 不发——tail 面只承诺
- *  content 六类,新 core 帧类型先经这里显式收编再出 wire)。 */
+ *  content 六类,新 core 帧类型先经这里显式收编再出 wire)。
+ *  ⚠️ **本函数是无状态逐帧投影**:`reasoning_end`(S-310 的推理权威段)不在这里 —— 它要按句柄攒段,
+ *  住在 {@link SubagentTailBus.onForwardFrame}(publish 侧是唯一知道句柄的地方)。 */
 export declare function projectTailFrame(e: Record<string, unknown> & {
     type?: string;
 }): SubagentTailFrame | null;
@@ -50,9 +52,33 @@ export declare class SubagentTailBus {
      * 不需要"先有内容帧"才能学到"没有内容帧"。
      */
     private readonly modeByHandle;
+    /**
+     * 句柄 → 该句柄这条 tail 流上**在攒的推理段**(S-310)。
+     *
+     * 键必须是句柄,理由与 {@link modeByHandle} 同源再加一条硬的:两个并发子代的 `reasoning_delta` 在
+     * **同一个** forward sink 上交错到达,一只累积器会把两份思考拼成一段、再盖上其中一个的身份键。
+     *
+     * 生命期 = **有人在听的那段时间**:攒段住在 `hasSubscribers` 快门之内(tail 是 live-only 面,没人听
+     * 就不投影也不攒),最后一个订阅者走掉或句柄终态({@link forgetHandle})时整条删掉 ⇒ 本表恒被
+     * 订阅者数量所界,不需要第二道容量闸。
+     */
+    private readonly segByHandle;
     /** 三条 run 腿的 forward 回调里逐帧调(在 `hasSubscribers` 快门**之前**——没人在听时也要学,
      *  否则晚开的 tail 永远读不到供给形)。同值重复写是 no-op(热路径只付一次 Map.get)。 */
     noteHandleContentMode(bgAgentId: string, mode: TailContentMode): void;
+    /**
+     * 🔴 **三条 run 腿的 forward 回调唯一入口**(S-310 收口)——登记供给形 → 段界收段 → 逐帧投影 → publish。
+     *
+     * 此前这四步以**同一段六行代码**抄在三条腿上(sync 流腿、verify-resume 腿、resume-stream 腿),
+     * 差别为零;S-310 要给 tail 面补 `reasoning_end` 时,那就是第四、第五、第六份拷贝。收成一扇门之后
+     * 腿上只剩「句柄在不在」这一句判断,三腿不可能再分家(`test/subagent-tail-stream.test.ts` G18-G20)。
+     *
+     * 顺序即语义:权威段**先于**触发它的结构帧上 wire(消费端「整段替换已攒 delta」的替换点不与卡片交错),
+     * 与账本腿「文本行先于结构行」逐字同构。
+     */
+    onForwardFrame(bgAgentId: string, mode: TailContentMode, e: Record<string, unknown> & {
+        type?: string;
+    }): void;
     /**
      * 句柄终态时**撤销**登记(三条腿的 `onTaskNotification` 观察者调,与 `task_settled` 帧同处)。
      *
@@ -69,7 +95,7 @@ export declare class SubagentTailBus {
      * 的答案。core 今天把终态通知排在最后一条 forward 之后(fleet-bus 同注),复活又是人手动作,这条窗
      * 实际上不可达;真要关死需要给句柄加墓碑态,代价大于一位诊断标签的收益,故不做。
      */
-    forgetHandleContentMode(bgAgentId: string): void;
+    forgetHandle(bgAgentId: string): void;
     /** 路由读(按 tail 的 target 句柄)。缺席 = 不知道,路由出 `"unknown"`。 */
     handleContentMode(bgAgentId: string): TailContentMode | undefined;
     /** 两条 run 腿的 fwdInternals 调用点:帧已投影(projectTailFrame),null 不进来。 */

package/dist/fleet/subagent-tail-bus.js

@@ -1,5 +1,6 @@
 import { redactSecrets } from "../trace/redact.js";
 import { taskProgressEventData, toolStartEventData, toolEndEventData, textEndEventData } from "../trace/project.js";
+import { createReasoningSegments } from "../trace/model-segment.js";
 const TAIL_QUEUE_CAP = 512;
 export function projectTailFrame(e) {
     const t = e.type;
@@ -41,12 +42,31 @@ const HOST_MODE_CAP = 4096;
 export class SubagentTailBus {
     subs = new Map();
     modeByHandle = new Map();
+    segByHandle = new Map();
     noteHandleContentMode(bgAgentId, mode) {
         if (this.modeByHandle.get(bgAgentId) === mode)
             return;
         putBounded(this.modeByHandle, bgAgentId, mode);
     }
-    forgetHandleContentMode(bgAgentId) {
+    onForwardFrame(bgAgentId, mode, e) {
+        this.noteHandleContentMode(bgAgentId, mode);
+        if (!this.hasSubscribers(bgAgentId))
+            return;
+        let segs = this.segByHandle.get(bgAgentId);
+        if (segs === undefined) {
+            segs = createReasoningSegments();
+            this.segByHandle.set(bgAgentId, segs);
+        }
+        for (const end of segs.onEvent(e))
+            this.publish(bgAgentId, end);
+        const f = projectTailFrame(e);
+        if (f)
+            this.publish(bgAgentId, f);
+    }
+    forgetHandle(bgAgentId) {
+        for (const end of this.segByHandle.get(bgAgentId)?.cut() ?? [])
+            this.publish(bgAgentId, end);
+        this.segByHandle.delete(bgAgentId);
         this.modeByHandle.delete(bgAgentId);
     }
     handleContentMode(bgAgentId) {
@@ -84,8 +104,10 @@ export class SubagentTailBus {
             sub.closed = true;
             sub.wake?.();
             set.delete(sub);
-            if (set.size === 0 && this.subs.get(bgAgentId) === set)
+            if (set.size === 0 && this.subs.get(bgAgentId) === set) {
                 this.subs.delete(bgAgentId);
+                this.segByHandle.delete(bgAgentId);
+            }
         };
         const it = {
             [Symbol.asyncIterator]() {

package/dist/http/principal-gate.d.ts

@@ -44,6 +44,25 @@ export declare function principalTokenPresentedButUnverified(req: IncomingMessag
  * 调用链上的**证明三件套**,与本门(身份面)是两道门。
  */
 export declare function sendPrincipalRefusal(res: ServerResponse, req: IncomingMessage, config: ServiceConfig): void;
+/**
+ * 🔴 **「这个调用方读得到这一行 run 吗」的唯一谓词**(S-297 抽取;此前只活在 `server.ts runOwnerOk` 的
+ * 函数体里,而 `runOwnerOk` 把**判断**与**404 怎么发**焊在一起 —— 于是任何需要同一条判断但不想 404 的
+ * 读面(如 `/mcp` 面板的 `lastLegMcp`:非属主就不投这个键、面板照常 200)只能手抄一份,而手抄那份必然
+ * 漏掉下面这条窄互认臂:`explicitOperatorOk` 顶注已经为同族的病写过「SINGLE mint point,不要再造兄弟」)。
+ *
+ * 三条放行臂,别的一律不放:
+ *  · `owner === null` —— 无属主的行(dev / 存量),本来就是开放的;
+ *  · `principal === owner` —— 自己的行。⚠️ `principal` 必须是**验过**的身份(`gatedPrincipal`),
+ *    不是自述头 —— `owner` 是创建时从验过的 principal 落库的,拿自述头来比就等于谁都能读别人的 run;
+ *  · [ref] C8 **窄互认**:非 `requirePrincipal` 部署上那批 `anon:shell-live` 哨兵行 + 无身份的调用方
+ *    (cli 停发哨兵头后的存量会话,否则「能续跑但看不见」)。`gatedPrincipal` 的回值是 `string | undefined`
+ *    ⇒ 原文那半个 `principal === null` 比较结构上不可达,抽取时一并去掉(语义逐字不变)。
+ *
+ * **不含 operator 臂**(刻意,[ref]⑥ 台账):跨属主 operator 在 poll/events/cancel 三读面上今天就是 404,
+ * 放宽它是一次独立裁定。需要 operator 臂的读面在**自己的调用点**显式并上 {@link explicitOperatorOk} ——
+ * 那样「谁多给了 operator 一条路」在代码上看得见,而不是被偷偷塞进共享谓词里。
+ */
+export declare function runOwnerReadable(principal: string | undefined, owner: string | null, config: ServiceConfig): boolean;
 /** The EXPLICIT operator gate (IMAGE-API-DESIGN.md §P2.4a MUST-FIX) — NOT the bare `isOperator` (whose empty-list
  *  "true-for-all" is an unrestricted-write exec door the instant OPERATOR_PRINCIPALS is empty). Requires a non-empty
  *  operator set AND a present principal IN it. The same form the preempt/resume endpoints already use.

package/dist/http/principal-gate.js

@@ -65,6 +65,13 @@ export function sendPrincipalRefusal(res, req, config) {
     }
     sendError(res, 401, "auth.principal_required", `missing principal header '${config.principalHeader}'`);
 }
+export function runOwnerReadable(principal, owner, config) {
+    if (owner === null)
+        return true;
+    if (principal === owner)
+        return true;
+    return !config.requirePrincipal && owner === "anon:shell-live" && principal === undefined;
+}
 export function explicitOperatorOk(principal, operatorPrincipals) {
     return operatorPrincipals.length > 0 && principal !== undefined && operatorPrincipals.includes(principal);
 }

package/dist/http/routes/sessions.js

@@ -3,14 +3,16 @@ import { a2aForScenario, mcpForScenario } from "../../config-center/facade.js";
 import { isUuidV7, isUuidShape, legacyUnownedSessionOk } from "../../security.js";
 import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
+import { recordFailOpen } from "../../observability/fail-open.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal } from "../principal-gate.js";
 const MCP_STATUS_TTL_MS = 5_000;
 const MCP_MATERIALIZE_TIMEOUT_MS = 10_000;
 const A2A_STATUS_TTL_MS = 5_000;
 const A2A_MATERIALIZE_TIMEOUT_MS = 10_000;
 const MEMORY_STATUS_TTL_MS = 5_000;
+const LAST_LEG_LEDGER_TIMEOUT_MS = 2_000;
 const A2A_PANEL_MAX_TOOL_NAMES = 200;
 export function createSessionsLocal() {
     return {
@@ -21,6 +23,44 @@ export function createSessionsLocal() {
         memoryStatusCache: new Map(),
     };
 }
+async function lastLegMcpFor(deps, sessionId, principal) {
+    let timer;
+    try {
+        return await Promise.race([
+            readLastLegMcp(deps, sessionId, principal),
+            new Promise((r) => { timer = setTimeout(() => { recordFailOpen("server.mcp-panel.last-leg-unreadable", `ledger read exceeded ${LAST_LEG_LEDGER_TIMEOUT_MS}ms`); r(undefined); }, LAST_LEG_LEDGER_TIMEOUT_MS); }),
+        ]);
+    }
+    catch (e) {
+        recordFailOpen("server.mcp-panel.last-leg-unreadable", e instanceof Error ? e.message : String(e ?? ""));
+        return undefined;
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+async function readLastLegMcp(deps, sessionId, principal) {
+    const runStore = deps.runStore;
+    if (!runStore || sessionId === null)
+        return undefined;
+    const latest = await runStore.latestRunForSession(sessionId);
+    if (latest === undefined)
+        return undefined;
+    if (!runOwnerReadable(principal, latest.owner, deps.config) && !explicitOperatorOk(principal, deps.config.operatorPrincipals))
+        return undefined;
+    const events = await runStore.getEvents(latest.taskId, 0);
+    for (let i = events.length - 1; i >= 0; i--) {
+        const ev = events[i];
+        if (ev.type !== "wiring_manifest")
+            continue;
+        const mcp = ev.data?.mcp;
+        if (!Array.isArray(mcp))
+            return undefined;
+        return { runId: latest.taskId, at: ev.ts, mcp };
+    }
+    return undefined;
+}
 export async function handleSessions(req, res, url, ctx) {
     const miss = { fell: false };
     await handleSessionsBody(req, res, url, ctx, miss);
@@ -71,17 +111,18 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
     {
         const mm = /^\/v1\/sessions\/([^/]+)\/mcp$/.exec(url);
         if (mm && req.method === "GET") {
-            if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
+            const principal = gatedPrincipal(req, deps.config);
+            if (deps.config.requirePrincipal && !principal) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
+            const lastLegMcp = await lastLegMcpFor(deps, safeDecode(mm[1]), principal);
             const specs = mcpForScenario(deps.config.mcpServers, deps.config.defaultScenario);
+            const cacheKey = `${deps.config.defaultScenario}::${principal ?? ""}`;
             if (!specs || specs.length === 0) {
-                sendJson(res, 200, { servers: [], asOf: new Date().toISOString() });
+                sendJson(res, 200, { servers: [], asOf: new Date().toISOString(), ...(lastLegMcp === undefined ? {} : { lastLegMcp }) });
                 return;
             }
-            const principal = gatedPrincipal(req, deps.config);
-            const cacheKey = `${deps.config.defaultScenario}::${principal ?? ""}`;
             const cached = mcpStatusCache.get(cacheKey);
             if (!cached || Date.now() - cached.at > MCP_STATUS_TTL_MS) {
                 if (mcpStatusCache.size > 1024)
@@ -114,7 +155,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
                 })();
                 mcpStatusCache.set(cacheKey, { at: Date.now(), panel });
             }
-            sendJson(res, 200, await mcpStatusCache.get(cacheKey).panel);
+            sendJson(res, 200, { ...(await mcpStatusCache.get(cacheKey).panel), ...(lastLegMcp === undefined ? {} : { lastLegMcp }) });
             return;
         }
     }

package/dist/http/routes/tasks.js

@@ -4,7 +4,8 @@ import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, resumeAtHttpStat
 import { stripResumeToken } from "../../terminal.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../../fleet/fleet-bus.js";
-import { defaultSubagentTailBus, projectTailFrame } from "../../fleet/subagent-tail-bus.js";
+import { defaultSubagentTailBus } from "../../fleet/subagent-tail-bus.js";
+import { createReasoningSegments, reasoningStreamOfTask } from "../../trace/model-segment.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
 import { createLedgerSink } from "../../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../../trace/engine-notice-wire.js";
@@ -12,7 +13,7 @@ import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../..
 import { mintCancelledResult } from "../../run-cancel-context.js";
 import { recordResourceWindow } from "../../resource-window.js";
 import { redactSecrets } from "../../trace/redact.js";
-import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, toolRosterDeltaEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, textEndEventData } from "../../trace/project.js";
+import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, toolRosterDeltaEventData, toolProgressEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, textEndEventData } from "../../trace/project.js";
 import { cascadeConfig, runMeta } from "../run-meta.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
@@ -313,23 +314,21 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     const streamBody = async () => {
                         await withPrincipal(principal, async () => {
                             const tailContentMode = prepared.spec.forwardSubagentEvents === true ? "on" : "progress_only";
+                            const childReasoning = createReasoningSegments();
+                            const topReasoning = createReasoningSegments();
                             const fwdInternals = {
                                 onForwardEvent: (e) => {
                                     fleetPub?.onForwardEvent(e);
                                     ledgerSink?.onForwardEvent(e);
                                     {
                                         const bg = e.bgAgentId;
-                                        if (bg !== undefined) {
-                                            defaultSubagentTailBus.noteHandleContentMode(bg, tailContentMode);
-                                            if (defaultSubagentTailBus.hasSubscribers(bg)) {
-                                                const f = projectTailFrame(e);
-                                                if (f)
-                                                    defaultSubagentTailBus.publish(bg, f);
-                                            }
-                                        }
+                                        if (bg !== undefined)
+                                            defaultSubagentTailBus.onForwardFrame(bg, tailContentMode, e);
                                     }
                                     if (res.writableEnded)
                                         return;
+                                    for (const end of childReasoning.onEvent(e))
+                                        sseData(res, end);
                                     const t = e.type;
                                     if (t === "task_progress") {
                                         sseData(res, { type: "task_progress", ...taskProgressEventData(e) });
@@ -359,7 +358,10 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                 onTaskNotification: (n, opts) => {
                                     if (n.task_type === "workflow")
                                         return;
-                                    defaultSubagentTailBus.forgetHandleContentMode(n.task_id);
+                                    if (!res.writableEnded)
+                                        for (const end of childReasoning.cut(reasoningStreamOfTask(n.task_id, n.sessionId)))
+                                            sseData(res, end);
+                                    defaultSubagentTailBus.forgetHandle(n.task_id);
                                     if (defaultSubagentTailBus.hasSubscribers(n.task_id)) {
                                         defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
                                     }
@@ -393,6 +395,8 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                             for await (const ev of liveStream) {
                                 if (closed)
                                     break;
+                                for (const end of ev.type === "done" ? [...childReasoning.cut(), ...topReasoning.cut()] : topReasoning.onEvent(ev))
+                                    sseData(res, end);
                                 if (ev.type === "message_committed" && ev.role === "user")
                                     userMsgEntryId = ev.entryId;
                                 const cancelVerbAtDone = ev.type === "done" && durableTaskId !== undefined && cancelledViaVerb.has(durableTaskId);
@@ -483,6 +487,16 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                     if (rosterDelta !== undefined)
                                         sseData(res, { type: "tool_roster_delta", ...rosterDelta });
                                 }
+                                else if (ev.type === "tool_progress") {
+                                    const progress = toolProgressEventData(ev);
+                                    if (progress !== undefined)
+                                        sseData(res, { type: "tool_progress", ...progress });
+                                }
+                                else if (ev.type === "tool_disclosure") {
+                                    const disclosure = toolDisclosureEventData(ev);
+                                    if (disclosure !== undefined)
+                                        sseData(res, { type: "tool_disclosure", ...disclosure });
+                                }
                                 else if (ev.type === "human_input") {
                                     sseData(res, { type: "human_input", ...humanInputEventData(ev) });
                                 }

package/dist/http/routes/workflows.js

@@ -246,7 +246,12 @@ function projectLegApprovalKeys(agent) {
     };
 }
 function projectParkRow(p) {
-    return { callKey: p.callKey, sessionId: p.sessionId, originRunId: p.originRunId };
+    return {
+        callKey: p.callKey,
+        sessionId: p.sessionId,
+        originRunId: p.originRunId,
+        ...(p.originUnconfirmed === true ? { originUnconfirmed: true } : {}),
+    };
 }
 function summarizeWorkflowDetail(run) {
     const isDone = (s) => s === "completed" || s === "failed";
@@ -343,6 +348,7 @@ function summarizeWorkflowDetail(run) {
         ...(run.error !== undefined ? { error: redactErrorMessage(run.error) ?? "" } : {}),
         ...(run.errorCode !== undefined ? { errorCode: run.errorCode } : {}),
         ...(run.parks !== undefined ? { parks: run.parks.map(projectParkRow) } : {}),
+        ...(run.resumeAdmissionIncomplete === true ? { resumeAdmissionIncomplete: true } : {}),
         ...(run.result !== undefined ? { result: redactSecrets(run.result) } : {}),
         phases,
         ...(unphasedView ? { unphased: unphasedView } : {}),

package/dist/http/server.js

@@ -26,14 +26,14 @@ import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import {} from "../orchestration/workflow-agent-steer.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
-import { defaultSubagentTailBus, projectTailFrame } from "../fleet/subagent-tail-bus.js";
+import { defaultSubagentTailBus } from "../fleet/subagent-tail-bus.js";
 import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, resolveApprovalLeg, resolveStreamApprovalGate } from "../tool-approval.js";
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import {} from "../observability/rate-limit.js";
 import { withPrincipal } from "../observability/principal-context.js";
-import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
+import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
 import { createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
@@ -85,7 +85,7 @@ export { cascadeConfig };
 import { handleImages, createImagesLocal, coarseStatusForState, errorCodeForExit } from "./routes/images.js";
 export { coarseStatusForState, errorCodeForExit };
 import { sendJson, sendError, httpErrorCode, msg, isSseResponse } from "./send.js";
-import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, isOperator, sendPrincipalRefusal } from "./principal-gate.js";
+import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, isOperator, runOwnerReadable, sendPrincipalRefusal } from "./principal-gate.js";
 import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflict.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 export { explicitOperatorOk, isOperator };
@@ -1453,14 +1453,8 @@ export function createHttpServer(rawDeps) {
                             fleetPub?.onForwardEvent(e);
                             {
                                 const bg = e.bgAgentId;
-                                if (bg !== undefined) {
-                                    defaultSubagentTailBus.noteHandleContentMode(bg, verifyTailContentMode);
-                                    if (defaultSubagentTailBus.hasSubscribers(bg)) {
-                                        const f = projectTailFrame(e);
-                                        if (f)
-                                            defaultSubagentTailBus.publish(bg, f);
-                                    }
-                                }
+                                if (bg !== undefined)
+                                    defaultSubagentTailBus.onForwardFrame(bg, verifyTailContentMode, e);
                             }
                             if (rsV && taskId)
                                 verifySink.onForwardEvent(e);
@@ -1474,7 +1468,7 @@ export function createHttpServer(rawDeps) {
                         onTaskNotification: (n, opts) => {
                             if (n.task_type === "workflow")
                                 return;
-                            defaultSubagentTailBus.forgetHandleContentMode(n.task_id);
+                            defaultSubagentTailBus.forgetHandle(n.task_id);
                             if (defaultSubagentTailBus.hasSubscribers(n.task_id)) {
                                 defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
                             }
@@ -1578,14 +1572,8 @@ export function createHttpServer(rawDeps) {
                             fleetPub?.onForwardEvent(e);
                             {
                                 const bg = e.bgAgentId;
-                                if (bg !== undefined) {
-                                    defaultSubagentTailBus.noteHandleContentMode(bg, tailContentMode);
-                                    if (defaultSubagentTailBus.hasSubscribers(bg)) {
-                                        const f = projectTailFrame(e);
-                                        if (f)
-                                            defaultSubagentTailBus.publish(bg, f);
-                                    }
-                                }
+                                if (bg !== undefined)
+                                    defaultSubagentTailBus.onForwardFrame(bg, tailContentMode, e);
                             }
                             if (!rs || !taskId)
                                 return;
@@ -1604,7 +1592,7 @@ export function createHttpServer(rawDeps) {
                         onTaskNotification: (n, opts) => {
                             if (n.task_type === "workflow")
                                 return;
-                            defaultSubagentTailBus.forgetHandleContentMode(n.task_id);
+                            defaultSubagentTailBus.forgetHandle(n.task_id);
                             if (defaultSubagentTailBus.hasSubscribers(n.task_id)) {
                                 defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
                             }
@@ -1699,6 +1687,13 @@ export function createHttpServer(rawDeps) {
                                     await append("tool_roster_delta", rosterDelta);
                                 break;
                             }
+                            case "tool_disclosure": {
+                                await flush();
+                                const disclosure = toolDisclosureEventData(ev);
+                                if (disclosure !== undefined)
+                                    await append("tool_disclosure", disclosure);
+                                break;
+                            }
                             case "human_input":
                                 await flush();
                                 await append("human_input", humanInputEventData(ev));
@@ -2334,8 +2329,7 @@ export function createHttpServer(rawDeps) {
             sendPrincipalRefusal(res, req, deps.config);
             return false;
         }
-        const legacyShellOwner = !deps.config.requirePrincipal && owner === "anon:shell-live" && (principal === undefined || principal === null);
-        if (!legacyShellOwner && owner !== null && principal !== owner) {
+        if (!runOwnerReadable(principal, owner, deps.config)) {
             if (notFoundForm === "session")
                 sendError(res, 404, "not_found.session", "session not found");
             else
@@ -2531,6 +2525,7 @@ const WORKER_SWAP_REDEEMABLE = {
     real_approval_forged: false,
     read_face_damaged: false,
     read_face_forged: false,
+    write_face_damaged: false,
     constraint_chain_missing: false,
 };
 function checkpointRowRedeemableElsewhere(reason) {