@sema-agent/server 7.84.0 → 7.86.0

package/dist/http/routes/approvals-assistant.js

@@ -7,6 +7,7 @@ import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
 import { MAX_APPROVAL_REASON_CHARS } from "../../approval-hmac.js";
+import { PLAN_APPROVE_PERMISSION_MODES_AFTER, isPlanApprovePermissionModeAfter, storedBodyPermissionMode } from "../../task-settings.js";
 import { MAX_APPROVAL_NONCE_CHARS } from "../../plugins/approval-nonce-store.js";
 import { redactedPreview, redactSecrets } from "../../trace/redact.js";
 import { redactRiskDescriptor } from "../../observability/run-terminal-log.js";
@@ -46,6 +47,35 @@ export function decideBodyKeyIssue(raw) {
         unsupportedKeys: buckets.unsupported.slice(0, MAX_KEY_ECHO),
     };
 }
+const PLAN_REVIEW_BODY_DECLARED_KEYS = [
+    "boundCallId", "decision", "editedPlan", "permissionModeAfter", "reason",
+];
+const ACCEPTED_PLAN_REVIEW_BODY = new Set(PLAN_REVIEW_BODY_DECLARED_KEYS);
+const UNSUPPORTED_PLAN_REVIEW_BODY = new Set([
+    "answer", "boundInputHash", "checkpointToken", "permissionMode", "remember", "sessionId", "taskId", "updatedInput",
+]);
+export function planReviewBodyKeyIssue(raw) {
+    if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const buckets = { unknown: [], unsupported: [] };
+    scanKeyClosure(raw, "", ACCEPTED_PLAN_REVIEW_BODY, UNSUPPORTED_PLAN_REVIEW_BODY, buckets);
+    if (buckets.unknown.length === 0 && buckets.unsupported.length === 0)
+        return null;
+    buckets.unknown.sort();
+    buckets.unsupported.sort();
+    const parts = [
+        ...(buckets.unknown.length > 0 ? [keyClosureClause(buckets.unknown, "unknown (not a plan-review-request key — check the spelling)")] : []),
+        ...(buckets.unsupported.length > 0 ? [keyClosureClause(buckets.unsupported, "unsupported (a sibling approval door's field, a submit-body key, or a path parameter — never read from this body)")] : []),
+    ];
+    return {
+        message: `body: unrecognized top-level key(s) — refused rather than dropped, because a dropped key reads as "in effect" to the caller ` +
+            `(a misspelled \`permissionModeAfter\` silently leaves this task read-only after you approved its plan). ` +
+            `${parts.join("; ")}. ` +
+            `Accepted: ${[...ACCEPTED_PLAN_REVIEW_BODY].sort().join(",")}`,
+        unknownKeys: buckets.unknown.slice(0, MAX_KEY_ECHO),
+        unsupportedKeys: buckets.unsupported.slice(0, MAX_KEY_ECHO),
+    };
+}
 export function decisionReasonOf(body) {
     return typeof body.reason === "string" && body.reason !== "" ? body.reason : undefined;
 }
@@ -133,7 +163,7 @@ async function decideIdempotentReplay(cs, args) {
 export async function handleApprovalsAssistant(req, res, match, ctx) {
     const { deps } = ctx;
     const { preemptableRuns } = ctx.registry;
-    const { readJson, rateLimited, quotaExceeded } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, safeDecode } = ctx.helpers;
     const { resumeCheckpoint, resumePreempted, resumePlanReview } = ctx.legs;
     {
         const cs = deps.checkpointStore;
@@ -164,13 +194,9 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     sendError(res, 501, "capability.store_required", "approval exemptions need a store backend");
                     return;
                 }
-                let exSessionId;
-                let exToolName;
-                try {
-                    exSessionId = decodeURIComponent(match.params.sessionId);
-                    exToolName = match.params.tool !== undefined ? decodeURIComponent(match.params.tool) : undefined;
-                }
-                catch {
+                const exSessionId = safeDecode(match.params.sessionId);
+                const exToolName = match.params.tool !== undefined ? safeDecode(match.params.tool) : undefined;
+                if (exSessionId === null || exToolName === null) {
                     sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
                     return;
                 }
@@ -365,9 +391,16 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "edit" ? "edit" : body?.decision === "reject" ? "reject" : undefined;
             if (!decision) {
-                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'edit' | 'reject', editedPlan?, reason? }");
+                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'edit' | 'reject', editedPlan?, reason?, permissionModeAfter? }");
                 return;
             }
+            {
+                const keyIssue = planReviewBodyKeyIssue(body);
+                if (keyIssue) {
+                    sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
+                    return;
+                }
+            }
             if (decision === "edit" && (typeof body.editedPlan !== "string" || body.editedPlan.length === 0)) {
                 sendError(res, 400, "request.field_conflict", "decision 'edit' requires a non-empty editedPlan (the operator's revised plan)");
                 return;
@@ -380,6 +413,14 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "request.field_conflict", `editedPlan is only valid with decision 'edit' (got '${decision}')`);
                 return;
             }
+            if (body.permissionModeAfter !== undefined && !isPlanApprovePermissionModeAfter(body.permissionModeAfter)) {
+                sendError(res, 400, "request.field_invalid", `permissionModeAfter must be one of ${PLAN_APPROVE_PERMISSION_MODES_AFTER.map((m) => JSON.stringify(m)).join(" | ")} when present (the permission mode this task continues in once the plan is approved; absent = "default", which keeps asking before each write)`);
+                return;
+            }
+            if (decision !== "approve" && body.permissionModeAfter !== undefined) {
+                sendError(res, 400, "request.field_conflict", `permissionModeAfter is only valid with decision 'approve' (got '${decision}')`);
+                return;
+            }
             if (body.reason !== undefined && typeof body.reason !== "string") {
                 sendError(res, 400, "request.field_invalid", "reason must be a string");
                 return;
@@ -423,7 +464,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
                 const storeNowMs = await store.nowMs();
                 const hdr = (n) => { const h = req.headers[n]; return Array.isArray(h) ? h[0] : h; };
-                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, { sessionId: run.sessionId, boundCallId: planNonce ?? null, boundInputHash: decision === "edit" ? editedPlanBinding(body.editedPlan) : null, decision, reason: typeof body.reason === "string" ? body.reason : null }, deps.config, { actionBinding: false, nowSec: Math.floor(storeNowMs / 1000) });
+                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, { sessionId: run.sessionId, boundCallId: planNonce ?? null, boundInputHash: decision === "edit" ? editedPlanBinding(body.editedPlan) : null, decision, reason: typeof body.reason === "string" ? body.reason : null, ...(isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? { permissionModeAfter: body.permissionModeAfter } : {}) }, deps.config, { actionBinding: false, nowSec: Math.floor(storeNowMs / 1000) });
                 if (!proof.ok) {
                     sendError(res, proof.status, proof.errorCode, proof.error);
                     return;
@@ -438,6 +479,13 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
+            if (body.permissionModeAfter !== undefined) {
+                const storedCtx = await deps.checkpointStore?.getCtx(run.sessionId).catch(() => null);
+                if (storedCtx?.body !== undefined && storedBodyPermissionMode(storedCtx.body) !== "plan") {
+                    sendError(res, 400, "request.field_conflict", "permissionModeAfter does not apply to this task: it was not submitted with permissionMode \"plan\", so approving the plan lifts no read-only restriction");
+                    return;
+                }
+            }
             if (singleUse !== undefined) {
                 const { proof: onceOnly, store } = singleUse;
                 const fresh = await store.consume(run.sessionId, onceOnly.nonce, onceOnly.acceptedBeforeMs);
@@ -450,18 +498,15 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
             }
-            const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, { taskId, principalPresent: principal !== undefined }, true, { principal: deciderPrincipal, explicitOperator });
+            const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, { taskId, principalPresent: principal !== undefined }, true, { principal: deciderPrincipal, explicitOperator }, isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined);
             sendResumeOutcome(res, out, deps.logger);
             return;
         }
         if (match.decl.id === "approval-decide") {
             if (rateLimited(req, res) || quotaExceeded(req, res))
                 return;
-            let sessionId;
-            try {
-                sessionId = decodeURIComponent(match.params.sessionId);
-            }
-            catch {
+            const sessionId = safeDecode(match.params.sessionId);
+            if (sessionId === null) {
                 sendError(res, 400, "request.path_malformed", "malformed approval id (invalid percent-encoding)");
                 return;
             }

package/dist/http/routes/capabilities.js

@@ -13,6 +13,7 @@ import { projectMemoryEngineCapability } from "../../memory-posture.js";
 import { projectWriteProtectionCapability } from "../../write-protection.js";
 import { projectSqlEngineCapability } from "../../sql-engine-posture.js";
 import { projectWebSearchCapability } from "../../plugins/web-search.js";
+import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
 import { workflowModelAllowlistFor, selfOrchestrationDenial } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
@@ -80,6 +81,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 webSearch: projectWebSearchCapability(deps.webSearchProvider),
                 sessionBackgroundable: Boolean(deps.runStore),
                 runMemoryCaptureOptOut: Boolean(deps.runStore),
+                mcpReconnect: Boolean(deps.runStore) && Boolean(deps.sessionStorage?.ownerOf),
                 sharedMemory: Boolean(deps.sharedMemoryStore && deps.orgMemoryDirectory),
                 adoption: Boolean(deps.backend?.adoptionLog) && deps.config.operatorPrincipals.length > 0,
                 memoryBundle: Boolean(deps.memoryBundleExport && deps.memoryBundleImport) && deps.config.operatorPrincipals.length > 0,
@@ -125,6 +127,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 interactiveTools: true,
                 projectContext: cwdHonored(deps.config),
                 callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
+                executionLane: projectExecutionLaneCapability(deps.config),
                 mcpInjection: mcpInjectionHonored(deps.config),
                 a2a: true,
                 a2aInjection: a2aInjectionHonored(deps.config),

package/dist/http/routes/images.js

@@ -41,7 +41,7 @@ const RUNNER_ERROR_CODES = new Set(["band-conflict", "duplicate", "disk", "timeo
 const SANDBOX_BASE_PROFILE = "sandbox-base";
 export async function handleImages(req, res, match, ctx) {
     const { deps } = ctx;
-    const { readJson } = ctx.helpers;
+    const { readJson, safeDecode } = ctx.helpers;
     const { source } = ctx.req;
     const { bakeSubmitLimiter } = ctx.local.images;
     if (deps.imageBakes && isBakeRouteId(match.decl.id)) {
@@ -128,7 +128,11 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
             }
-            const bakeId = decodeURIComponent(match.params.bakeId);
+            const bakeId = safeDecode(match.params.bakeId);
+            if (bakeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const bake = await bakes.getBake(bakeId);
             if (!bake) {
                 sendError(res, 404, "not_found.bake", "bake not found");
@@ -142,7 +146,11 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
             }
-            const bakeId = decodeURIComponent(match.params.bakeId);
+            const bakeId = safeDecode(match.params.bakeId);
+            if (bakeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const bake = await bakes.getBake(bakeId);
             if (!bake) {
                 sendError(res, 404, "not_found.bake", "bake not found");
@@ -178,7 +186,11 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 403, "auth.bake_runner_only", "bake-runner only");
                 return;
             }
-            const bakeId = decodeURIComponent(match.params.bakeId);
+            const bakeId = safeDecode(match.params.bakeId);
+            if (bakeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const body = (await readJson(req));
             const runnerId = typeof body.runnerId === "string" && body.runnerId.length > 0 ? body.runnerId : (principal ?? source ?? cfg.runnerPrincipal);
             const claimed = await bakes.claimBake(bakeId, runnerId, cfg.leaseMs);
@@ -194,7 +206,11 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 403, "auth.bake_runner_only", "bake-runner only");
                 return;
             }
-            const bakeId = decodeURIComponent(match.params.bakeId);
+            const bakeId = safeDecode(match.params.bakeId);
+            if (bakeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const bake = await bakes.getBake(bakeId);
             if (!bake) {
                 sendError(res, 404, "not_found.bake", "bake not found");
@@ -238,7 +254,11 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
             }
-            const bakeId = decodeURIComponent(match.params.bakeId);
+            const bakeId = safeDecode(match.params.bakeId);
+            if (bakeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const bake = await bakes.getBake(bakeId);
             if (!bake) {
                 sendError(res, 404, "not_found.bake", "bake not found");
@@ -335,7 +355,12 @@ export async function handleImages(req, res, match, ctx) {
             return;
         }
         if (match.decl.id === "image-by-digest") {
-            const entry = await idx.getByDigest(decodeURIComponent(match.params.digest));
+            const digest = safeDecode(match.params.digest);
+            if (digest === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
+            const entry = await idx.getByDigest(digest);
             if (!entry || (!viewer.operator && entry.visibility === "tenant" && entry.tenantId !== viewer.tenantId)) {
                 sendError(res, 404, "not_found.image", "not found");
                 return;
@@ -344,7 +369,12 @@ export async function handleImages(req, res, match, ctx) {
             return;
         }
         if (match.decl.id === "image-by-profile") {
-            const entry = await idx.latestPublished(decodeURIComponent(match.params.profile), viewer);
+            const profile = safeDecode(match.params.profile);
+            if (profile === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
+            const entry = await idx.latestPublished(profile, viewer);
             if (!entry) {
                 sendError(res, 404, "not_found.image", "not found");
                 return;

package/dist/http/routes/mcp-reconnect.d.ts

@@ -0,0 +1,56 @@
+/**
+ * S-381(core 7.22.0 [ref] 的 server 半场;提货单 [ref] ⓪ @server 第 3 条 / 判据帖 [ref] G1)——
+ * **会话内 MCP re-dial** 的 wire 面:
+ *
+ *   `POST /v1/sessions/:id/mcp/reconnect`  body `{ server: string }`
+ *     → 200 `{ taskId, sessionId, server, outcome: "accepted" | "refused" | "unsupported", … }`
+ *
+ * 语义 = core `TaskStream.reconnectMcpServer(server)`:传输断了的那台 MCP server,在**不结束任务**的前提下
+ * 重拨一次号。**一台具名 server,必需,没有全部形**(core 原话:全体形会 CLOSE 掉健康连接,而拥有设备/端口的
+ * stdio server 恰恰是这个动词存在的理由)。
+ *
+ * ── 🔴 一次交易,不是一个「刷新」按钮(core 原话,必须进 UI 文案与契约)───────────────────────────────
+ * **失败的重拨让 server 留在断线状态** —— 旧连接在拨新号**之前**就被关(对拥有设备/端口的 stdio server 没有
+ * 别的顺序可用),所以一次失败的拨号花掉了一条能用的连接:server 保持断开、**它的工具从模型名册撤走**,在飞
+ * 调用随之失败。**在一台健康的 server 上提供「重连」按钮 = 提供一次交易**。契约 §G.7 与本面的 `outcome`
+ * 三词都按这句话写;壳不许把它渲成无代价的刷新。
+ *
+ * ── 三态映射(`unsupported` 是**本仓自己的词**,core 无此词)──────────────────────────────────────
+ *  · core `reconnected`  → `accepted`
+ *  · core `refused`      → `refused`
+ *  · core `not_declared` → `refused`(未知 server 名是**名册事实**,不是引擎能力事实)
+ *  · core **抛** `mcp.reconnect_unavailable`(本 run 未声明任何 MCP)→ `unsupported`
+ * 🔴 **`outcome` 是唯一判别键**:三态**全部走 200**。HTTP 状态只回答「动词有没有到达引擎」——与 steer 回执的
+ * 「branch on `delivery`, not the status」同一条律。把 `refused` 挂到 4xx 会让同一件事有两个判别键,而
+ * `unsupported` 挂 409 更会把「这条 run 没有 MCP 面」谎报成一个活性问题。
+ *
+ * ── 下一步动作按 `status`,不解析 `reason`(core [ref] 键表逐字)────────────────────────────────
+ * `status.errorCode` / `status.httpStatus` 是机器面(`http_status` 401 是一扇重新授权的门,`spawn_failed` 是
+ * 缺二进制);`reason` 是**人读**的一句话,经本仓 `redactSecrets` + 定长截断后投出(它可能嵌远端文本),
+ * 消费端**不许**解析它。名册**按 `tools` 的在场性**投成 `toolNames`(present-iff),**不按 `outcome`**。
+ *
+ * ── 查找与拒绝形(与 steer / capture-optout **同一只**,不新造)───────────────────────────────────
+ * 路径是 session,动词挂在 **run 句柄**上 ⇒ 会话属主门(`sessionStorage.ownerOf`,未知与他人**同码同串**
+ * 404 无 oracle,与 `POST /v1/sessions/:id/notify` 逐字同形)→ `getActiveTaskId` 取本会话的活 run →
+ * `steerableRuns` 取本副本活流。非 live 的四臂一码 409 `steering.not_running`,判据取词表属主
+ * (`isParkedRunStatus` / `isTerminalRunStatus`)与 `runProvenElsewhere`(手抄已收编成一只谓词,S-430 起同住 `plugins/store-contracts.ts`)。
+ * 显式 operator 可重拨任何租户的会话(监督动作,与 notify / steer 同臂;**不是** bare `isOperator`)。
+ *
+ * ── 计费/门 ─────────────────────────────────────────────────────────────────────────────────────
+ * 零模型工作(不进 billable;不吃 drain / roster-pending);mutating ⇒ `rateLimited`。能力位 `mcpReconnect`
+ * = 持久 run 账面 ∧ 会话属主面(两道 501 的同一批 deps 推导出来,「说 yes 但 501」结构上不可能)。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type RouteCtx, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
+/** 本面的三词闭集 —— **`unsupported` 是本仓的词**(core 的三词是 `reconnected`/`refused`/`not_declared`)。 */
+export type McpReconnectOutcome = "accepted" | "refused" | "unsupported";
+export declare function handleMcpReconnect(req: IncomingMessage, res: ServerResponse, match: RouteMatch<McpReconnectRouteId>, ctx: RouteCtx): Promise<void>;
+export declare const MCP_RECONNECT_ROUTES: readonly [{
+    readonly id: "mcp-reconnect";
+    readonly pattern: RegExp;
+    readonly label: "/v1/sessions/:id/mcp/reconnect";
+    readonly methods: readonly ["POST"];
+}];
+/** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */
+export type McpReconnectRouteId = RouteIdsOf<typeof MCP_RECONNECT_ROUTES>;
+//# sourceMappingURL=mcp-reconnect.d.ts.map

package/dist/http/routes/mcp-reconnect.js

@@ -0,0 +1,139 @@
+import { z } from "zod";
+import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
+import { redactSecrets } from "../../trace/redact.js";
+import { sendJson, sendError } from "../send.js";
+import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import {} from "../route-ctx.js";
+import { assertNever } from "../route-ctx.js";
+const BodySchema = z.object({ server: z.string().min(1).max(190) }).strict();
+const NEUTRALIZED_TEXT_MAX = 200;
+const humanText = (s) => redactSecrets(s).slice(0, NEUTRALIZED_TEXT_MAX);
+function outcomeOf(coreOutcome) {
+    switch (coreOutcome) {
+        case "reconnected": return "accepted";
+        case "refused": return "refused";
+        case "not_declared": return "refused";
+        default: return assertNever(coreOutcome);
+    }
+}
+function projectStatus(s) {
+    return {
+        name: s.name,
+        status: s.status,
+        ...(s.errorCode !== undefined ? { errorCode: s.errorCode } : {}),
+        ...(s.httpStatus !== undefined ? { httpStatus: s.httpStatus } : {}),
+        ...(s.delivered !== undefined ? { delivered: s.delivered } : {}),
+        ...(s.serverInfo !== undefined ? { serverInfo: s.serverInfo } : {}),
+        ...(s.error !== undefined ? { error: humanText(String(s.error)) } : {}),
+        ...(s.transportClosed !== undefined ? { transportClosed: s.transportClosed } : {}),
+    };
+}
+function projectListingIncomplete(l) {
+    return {
+        reason: l.reason,
+        pages: l.pages,
+        ...(l.budgetMs !== undefined ? { budgetMs: l.budgetMs } : {}),
+        ...(l.error !== undefined ? { error: humanText(l.error) } : {}),
+    };
+}
+function projectResult(r) {
+    return {
+        server: r.server,
+        outcome: outcomeOf(r.outcome),
+        prefix: r.prefix,
+        toolCount: r.toolCount,
+        added: r.added,
+        removed: r.removed,
+        ...(r.tools !== undefined ? { toolNames: r.tools.map((t) => t.name) } : {}),
+        ...(r.reason !== undefined ? { reason: humanText(r.reason) } : {}),
+        ...(r.status !== undefined ? { status: projectStatus(r.status) } : {}),
+        ...(r.listingIncomplete !== undefined ? { listingIncomplete: projectListingIncomplete(r.listingIncomplete) } : {}),
+    };
+}
+export async function handleMcpReconnect(req, res, match, ctx) {
+    const { deps } = ctx;
+    switch (match.decl.id) {
+        case "mcp-reconnect": {
+            if (ctx.helpers.rateLimited(req, res))
+                return;
+            if (!deps.runStore) {
+                sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg|local)");
+                return;
+            }
+            const principal = gatedPrincipal(req, deps.config);
+            if (deps.config.requirePrincipal && principal === undefined) {
+                sendPrincipalRefusal(res, req, deps.config);
+                return;
+            }
+            const parsed = BodySchema.safeParse((await ctx.helpers.readJson(req)) ?? {});
+            if (!parsed.success) {
+                sendError(res, 400, "request.body_shape", "body must be { server: string (non-empty, at most 190 characters) } — one NAMED MCP server, required; there is no all-servers form (re-dialing every server would CLOSE the healthy ones, and a stdio server that owns a device cannot be re-dialed while the old connection still holds it)");
+                return;
+            }
+            const server = parsed.data.server;
+            const sessionId = ctx.helpers.safeDecode(match.params.sessionId);
+            if (sessionId === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
+            if (!deps.sessionStorage?.ownerOf) {
+                sendError(res, 501, "capability.session_ownership_required", "the MCP re-dial verb requires the session-ownership face (sessionStorage.ownerOf)");
+                return;
+            }
+            const owner = await deps.sessionStorage.ownerOf(sessionId);
+            if (owner === undefined) {
+                sendError(res, 404, "not_found.session", "session not found");
+                return;
+            }
+            const isOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
+            if (!isOperator && !ctx.helpers.runOwnerOk(req, res, owner, "session"))
+                return;
+            const activeTaskId = await deps.runStore.getActiveTaskId(sessionId);
+            const live = activeTaskId === undefined ? undefined : ctx.registry.steerableRuns.get(activeTaskId);
+            if (live) {
+                try {
+                    const result = await live.reconnectMcpServer(server);
+                    sendJson(res, 200, { taskId: activeTaskId, sessionId, ...projectResult(result) });
+                    return;
+                }
+                catch (e) {
+                    const code = e.code;
+                    const msg = e instanceof Error ? e.message : String(e);
+                    switch (code) {
+                        case "mcp.reconnect_unavailable":
+                            sendJson(res, 200, { taskId: activeTaskId, sessionId, server, outcome: "unsupported", reason: humanText(msg) });
+                            return;
+                        case "steering.invalid_content":
+                            sendError(res, 422, "steering.invalid_content", msg);
+                            return;
+                        case "steering.not_running":
+                            sendError(res, 409, "steering.not_running", "run just finished — the MCP re-dial verb needs a live run; a resumed continuation takes a fresh first listing of every declared server anyway");
+                            return;
+                        default: throw e;
+                    }
+                }
+            }
+            const run = activeTaskId === undefined ? undefined : await deps.runStore.getRun(activeTaskId);
+            if (run && isParkedRunStatus(run.status)) {
+                sendError(res, 409, "steering.not_running", "run is waiting on a pending decision — the MCP re-dial verb needs a live turn; a resumed continuation dials every declared server afresh (the re-dial applies to the current turn only and is not persisted), so resume this run first — a re-dial cannot be queued behind the decision");
+                return;
+            }
+            if (run && isTerminalRunStatus(run.status)) {
+                sendError(res, 409, "steering.not_running", "run already ended — the MCP re-dial verb needs a live run; the next submit of this session materializes every declared MCP server from scratch");
+                return;
+            }
+            if (run && runProvenElsewhere(run, deps.instanceId)) {
+                sendError(res, 409, "steering.not_running", "run is live on another replica — the MCP re-dial verb must reach the replica holding the stream (the MCP connections belong to that process); resend it there");
+                return;
+            }
+            sendError(res, 409, "steering.not_running", "no live steerable face for this session on this replica — there is no active run here to re-dial on (a verify or cascade submission exposes none, and an idle session holds no MCP connections at all)");
+            return;
+        }
+        default:
+            return assertNever(match.decl.id);
+    }
+}
+export const MCP_RECONNECT_ROUTES = [
+    { id: "mcp-reconnect", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/mcp\/reconnect$/, label: "/v1/sessions/:id/mcp/reconnect", methods: ["POST"] },
+];
+//# sourceMappingURL=mcp-reconnect.js.map

package/dist/http/routes/memory-policy.js

@@ -63,7 +63,7 @@ function sendScopeGateRefusal(res, gate) {
 }
 export async function handleMemoryPolicy(req, res, match, ctx) {
     const { deps } = ctx;
-    const { readJson } = ctx.helpers;
+    const { readJson, safeDecode } = ctx.helpers;
     switch (match.decl.id) {
         case "memory-export": {
             const principal = gatedPrincipal(req, deps.config);
@@ -135,11 +135,8 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
                 sendError(res, 501, "capability.memory_store_required", "memory sync requires a DB memory backend (MEMORY_ENGINE_BACKEND=pg|tidb)");
                 return;
             }
-            let scope;
-            try {
-                scope = decodeURIComponent(match.params.scope);
-            }
-            catch {
+            const scope = safeDecode(match.params.scope);
+            if (scope === null) {
                 sendError(res, 400, "memory_sync_invalid_scope", "malformed percent-encoding in :scope");
                 return;
             }

package/dist/http/routes/notify-wake.js

@@ -6,7 +6,7 @@ import { assertNever } from "../route-ctx.js";
 export async function handleNotifyWake(req, res, match, ctx) {
     const { deps } = ctx;
     const { steerableRuns } = ctx.registry;
-    const { readJson, rateLimited, quotaExceeded, leaseDenied } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, leaseDenied, safeDecode } = ctx.helpers;
     const { resumeWake } = ctx.legs;
     switch (match.decl.id) {
         case "session-notify": {
@@ -17,7 +17,11 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            const notifySession = decodeURIComponent(match.params.sessionId);
+            const notifySession = safeDecode(match.params.sessionId);
+            if (notifySession === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
             let nb;
             try {
                 nb = (await readJson(req));
@@ -111,7 +115,11 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            const wakeSession = decodeURIComponent(match.params.sessionId);
+            const wakeSession = safeDecode(match.params.sessionId);
+            if (wakeSession === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
             let wakeBody;
             try {
                 wakeBody = (await readJson(req));

package/dist/http/routes/run-memory-capture.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { isParkedRunStatus, isTerminalRunStatus } from "../../plugins/store-contracts.js";
+import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
@@ -31,10 +31,8 @@ export async function handleRunMemoryCapture(req, res, match, ctx) {
                 sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
                 return;
             }
-            if (run.owner !== null && run.owner !== principal) {
-                sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+            if (!ctx.helpers.runOwnerOk(req, res, run.owner))
                 return;
-            }
             const live = ctx.registry.steerableRuns.get(taskId);
             if (live) {
                 try {
@@ -79,7 +77,7 @@ export async function handleRunMemoryCapture(req, res, match, ctx) {
                 sendError(res, 409, "steering.not_running", "run already ended — the memory-capture opt-out verb needs a live run; submit the next turn of this session with memoryCapture: 'off' (the declaration writes the same one-way session record)");
                 return;
             }
-            const provenElsewhere = typeof run.instanceId === "string" && run.instanceId.length > 0 && deps.instanceId !== undefined && run.instanceId !== deps.instanceId;
+            const provenElsewhere = runProvenElsewhere(run, deps.instanceId);
             if (provenElsewhere) {
                 sendError(res, 409, "steering.not_running", "run is live on another replica — the memory-capture opt-out verb must reach the replica holding the stream; resend it there, or declare memoryCapture: 'off' on the next submit");
                 return;