@sema-agent/server 7.84.0 → 7.86.0

package/dist/http/routes/runs.js

@@ -3,7 +3,7 @@ import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactH
 import { isModelTextLedgerEventType } from "../../trace/ledger-events.js";
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer } from "@sema-agent/core";
-import { isTerminalRunStatus, isParkedRunStatus } from "../../plugins/store-contracts.js";
+import { isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-sql.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { HttpError, verifiedPrincipal, isUuidV7, encodeCheckpointScope } from "../../security.js";
@@ -64,7 +64,8 @@ export function projectDecisionActor(raw) {
     const parsed = AskDecisionActorSchema.safeParse(raw);
     return parsed.success ? parsed.data : undefined;
 }
-async function subagentReadGate(req, res, deps, runId, search) {
+async function subagentReadGate(req, res, ctx, runId, search) {
+    const { deps } = ctx;
     const principal = gatedPrincipal(req, deps.config);
     if (deps.config.requirePrincipal && principal === undefined) {
         sendPrincipalRefusal(res, req, deps.config);
@@ -72,10 +73,13 @@ async function subagentReadGate(req, res, deps, runId, search) {
     }
     const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
     const run = await deps.runStore.getRun(runId);
-    if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
+    if (!run) {
         sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
         return null;
     }
+    if (!trusted && !ctx.helpers.runOwnerOk(req, res, run.owner)) {
+        return null;
+    }
     const callerSession = new URLSearchParams(search).get("session");
     if (!trusted && run.sessionId && callerSession !== run.sessionId) {
         sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
@@ -88,7 +92,7 @@ function sendHandleMiss(res, run, thisInstanceId) {
         sendError(res, 404, "not_found.task_owner_settled", "no such background task handle here. Routing hint about its OWNER (not about this handle): the run has already settled, and background handles live in the replica-local registry for the parent's lifetime, so none of its handles are readable any more. Read the run's own outcome via GET /v1/runs/:id");
         return true;
     }
-    if (run.status === "running" && typeof run.instanceId === "string" && run.instanceId.length > 0 && thisInstanceId !== undefined && run.instanceId !== thisInstanceId) {
+    if (run.status === "running" && runProvenElsewhere(run, thisInstanceId)) {
         sendError(res, 404, "not_found.task_owner_elsewhere", "no such background task handle here. Routing hint about its OWNER (not about this handle): the run is executing on another replica, and this one's registry holds none of its handles. Ask the replica that owns the run, or read the run's own outcome via GET /v1/runs/:id");
         return true;
     }
@@ -429,10 +433,8 @@ export async function handleRuns(req, res, match, ctx) {
             sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
             return;
         }
-        if (!trusted && run.owner !== null && run.owner !== principal) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+        if (!trusted && !runOwnerOk(req, res, run.owner))
             return;
-        }
         if (!runSessionAcceptOk(req, res, run, "run.steer"))
             return;
         let parkQueueFull;
@@ -532,7 +534,7 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         if (run.status === "running") {
-            const provenElsewhere = typeof run.instanceId === "string" && run.instanceId.length > 0 && deps.instanceId !== undefined && run.instanceId !== deps.instanceId;
+            const provenElsewhere = runProvenElsewhere(run, deps.instanceId);
             if (provenElsewhere) {
                 sendNotRunning("run is live on another replica — a live steer must reach the replica holding the stream; resend it there, or use POST /v1/runs/:id/cancel for a run-level stop");
             }
@@ -714,10 +716,8 @@ export async function handleRuns(req, res, match, ctx) {
             sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
             return;
         }
-        if (!trusted && run.owner !== null && run.owner !== principal) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+        if (!trusted && !runOwnerOk(req, res, run.owner))
             return;
-        }
         if (!runSessionAcceptOk(req, res, run, "run.interrupt"))
             return;
         const sendInterruptNotRunning = (error) => sendError(res, 409, "steering.not_running", error);
@@ -731,7 +731,7 @@ export async function handleRuns(req, res, match, ctx) {
                 return;
             }
             if (status === "running") {
-                const provenElsewhere = typeof run.instanceId === "string" && run.instanceId.length > 0 && deps.instanceId !== undefined && run.instanceId !== deps.instanceId;
+                const provenElsewhere = runProvenElsewhere(run, deps.instanceId);
                 if (provenElsewhere) {
                     sendError(res, 409, "interrupt.not_held", "run is live on another replica — interrupt must reach the replica holding the stream; resend it there, or use POST /v1/runs/:id/cancel for a run-level stop");
                 }
@@ -812,10 +812,8 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-        if (!operator && run.owner !== null && run.owner !== principal) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+        if (!operator && !runOwnerOk(req, res, run.owner))
             return;
-        }
         if (!runSessionAcceptOk(req, res, run, "run.compact"))
             return;
         let compactBody;
@@ -894,10 +892,8 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-        if (!operator && run.owner !== null && run.owner !== principal) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+        if (!operator && !runOwnerOk(req, res, run.owner))
             return;
-        }
         if (!runSessionAcceptOk(req, res, run, "run.detach"))
             return;
         const live = steerableRuns.get(taskId);
@@ -913,7 +909,7 @@ export async function handleRuns(req, res, match, ctx) {
 }
 export async function handleRunVerbs(req, res, match, ctx) {
     const { deps } = ctx;
-    const { readJson, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, safeDecode, runSessionAcceptOk } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, safeDecode, runOwnerOk, runSessionAcceptOk } = ctx.helpers;
     if (match.decl.id === "run-subagent-output") {
         if (!deps.runStore || !deps.subagentTaskOutput) {
             sendError(res, 501, "capability.run_store_required", "subagent output reads require the run store");
@@ -925,7 +921,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 400, "request.path_malformed", "malformed subagent path (invalid percent-encoding)");
             return;
         }
-        const gated = await subagentReadGate(req, res, deps, runId, match.search);
+        const gated = await subagentReadGate(req, res, ctx, runId, match.search);
         if (!gated)
             return;
         const { run } = gated;
@@ -950,7 +946,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 400, "request.path_malformed", "malformed subagent path (invalid percent-encoding)");
             return;
         }
-        const gatedTail = await subagentReadGate(req, res, deps, runId, match.search);
+        const gatedTail = await subagentReadGate(req, res, ctx, runId, match.search);
         if (!gatedTail)
             return;
         const { run } = gatedTail;
@@ -1015,7 +1011,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 400, "request.path_malformed", "malformed task path (invalid percent-encoding)");
             return;
         }
-        const gatedB = await subagentReadGate(req, res, deps, runId, match.search);
+        const gatedB = await subagentReadGate(req, res, ctx, runId, match.search);
         if (!gatedB)
             return;
         const { run } = gatedB;
@@ -1113,10 +1109,12 @@ export async function handleRunVerbs(req, res, match, ctx) {
         }
         const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
         const run = await deps.runStore.getRun(runId);
-        if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
+        if (!run) {
             sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
             return;
         }
+        if (!trusted && !runOwnerOk(req, res, run.owner))
+            return;
         if (!runSessionAcceptOk(req, res, run, `subagent.${verb}`))
             return;
         const send409 = (errorCode, error) => sendError(res, 409, errorCode, error);

package/dist/http/routes/sessions.js

@@ -219,7 +219,11 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_store_required", "session head probe requires a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
-            const headSession = decodeURIComponent(match.params.sessionId);
+            const headSession = safeDecode(match.params.sessionId);
+            if (headSession === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
             const getHead = deps.sessionStorage?.getHead?.bind(deps.sessionStorage);
             let owner;
             let leafId;
@@ -262,7 +266,11 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_store_required", "session events require a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
-            const evSession = decodeURIComponent(match.params.sessionId);
+            const evSession = safeDecode(match.params.sessionId);
+            if (evSession === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
             if (sse.sseConnections >= (deps.sessionEventsMaxConnections ?? 256)) {
                 res.setHeader("retry-after", "5");
                 sendError(res, 503, "state.sse_connection_cap", "session-events connection cap reached — fall back to /head polling");
@@ -544,6 +552,7 @@ export async function handleSessions(req, res, match, ctx) {
                 const s = await entry.status;
                 sendJson(res, 200, {
                     sessionId,
+                    autoConsolidationArmed: deps.memoryAutoConsolidationArmed,
                     ...(s.captureOptedOut !== undefined ? { captureOptedOut: s.captureOptedOut } : {}),
                     ...(s.committedCount !== undefined ? { committedCount: s.committedCount } : {}),
                     ...(s.foldedCount !== undefined ? { foldedCount: s.foldedCount } : {}),

package/dist/http/routes/shared-memory.js

@@ -90,7 +90,11 @@ export async function handleSharedMemory(req, res, match, ctx) {
         }
         case "shared-memory-store-documents":
         case "shared-memory-store-document": {
-            const storeId = decodeURIComponent(match.params.store);
+            const storeId = ctx.helpers.safeDecode(match.params.store);
+            if (storeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const query = new URLSearchParams(match.search);
             const snapshot = await bindSnapshot(req, res, ctx);
             if (!snapshot)

package/dist/http/server.d.ts

@@ -417,6 +417,20 @@ export interface ServiceSeamDeps {
     sessionMemoryStatus?: {
         status: (sessionId: string) => Promise<SessionMemoryStatus>;
     };
+    /**
+     * S-403(core 7.22.0 [ref] W1)—— 本**部署**的自动整理武装事实,`GET /v1/sessions/:id/memory-status`
+     * 的 `autoConsolidationArmed` 格。
+     *
+     * 🔴 **唯一读法**:值必须由 core 的 `autoRunOnRecommendationEffective(RunnerDeps)` 组
+     * (契约 `memory.auto_consolidation.arming_has_one_resolver`),在 **boot 期算一次**
+     * (`boot/stage-10-http-server.ts` 单点)。`RunnerDeps.autoRunOnRecommendation` 的**缺席不是「关」**
+     * (core 7.21.1 起具名缺省是开,且只在 `memoryConsolidation` ∧ 可解整理模型席都接线时才真武装)——
+     * 所以「按席在不在场判」与「按席值判」**两个方向都错**,本仓不自铸第二套派生。
+     * 🔴 **必填,不是可选**:它是一个纯函数在 boot 期的答案,任何装配点都算得出;做成可选就等于在
+     * wire 上多出一个「答不出」的第三态,而这一格读错的方向是**把一台正在外流记忆的部署报成没在外流**。
+     * 装配漏接 ⇒ tsc 红(本行就是通知);测试桩在 `test/helpers/boot.ts` 显式给 false。
+     */
+    memoryAutoConsolidationArmed: boolean;
     /** [ref] 件②(core 5.59.0 `MemoryEngine.listExternalOriginEntries` / `listOriginClearances` /
      *  `clearEntryOrigin`):**外源标记人面**。启用 `GET /v1/memory/origin/external`、
      *  `GET /v1/memory/origin/clearances`、`POST /v1/memory/origin/entries/:entryId/clear`(三口 operator-only)。

package/dist/http/wire-types.d.ts

@@ -340,7 +340,11 @@ export interface TaskRequestBody {
      *  (`request-value-closure.ts` 的 `singleMemberOffFieldIssue`,与 `memoryCapture` 同表)。
      *  记忆面暗的部署(引擎未接线 / 多租户)上 `memory` 整键本就缺席,本声明无处落也无事可关。
      *  Rides the persisted body onto resume legs(与 `memoryWrite` 同姿势)。
-     *  ⏳ 子代地板(`ParentSpecSeat.memoryOff`:父关 ⇒ 子代/孙代同关)候 core 7.22.0,**本版不做**。 */
+     *  ✅ **子代地板自 core 7.22.0 到货,本仓零接线**:core 的 `parentSpecSeatOf` 从**这条 run 自己的**
+     *  `spec.memory.enabled === false` 铸 `ParentSpecSeat.memoryOff`,`applyParentSpecSeat` 作**无条件
+     *  REMOVAL** 施加(改写成 `{ …子代自己的 scopes, enabled:false }`,永不删键)⇒ 父关 ⇒ 子代 / 孙代 /
+     *  workflow 子 spec / 跨 run 唤醒与保留 resume 一律无记忆面。🚧 **tier-3 耐久复活不带**(core 已记残余)。
+     *  链路的机器锚:`test/memory-off-request.test.ts` ⑥ 段(亲读 core dist 的铸点与施加点)。 */
     memory?: "off";
     /** 142-S4 projectId 线程化([ref] §2):这个 run 归属的项目(center 登记簿键,generic lowercase
      *  UUID — core S1 `resolveProjectId` marker 或 S3 无仓 mint 的产物;客户端只透传,零铸造权威)。是「哪个

package/dist/memory-scope.d.ts

@@ -221,6 +221,22 @@ declarations?: {
  * `normalizeMemorySpec(spec)?.enabled === true`。S-405 之后 `memory:"off"` 铸的是「键在场 + `enabled:false`」(保留事实),
  * 任何按「键在不在场」判挂没挂的读者从那一天起都读错(改前 `memory-notice` 正是那样,把无记忆面的披露一起吞掉)。
  * 消费方拿本函数的布尔,不拿 `spec.memory` 自己判。
+ *
+ * ⚠️ **本函数会抛,而「抛」本身就是一条判据**(S-424 补注)。`normalizeMemorySpec` 对两形直接 throw
+ * (亲核安装态 core 7.22.0 `dist/core/memory.js:367-372` 与 `:373-385`):
+ *  · 单数 `scope` 键在场 ⇒ `code:"config.memory_scope_spelling"`(core 已删的旧拼写;它的报错原话
+ *    是「Refusing to start with memory silently off」—— 静默关闭正是那次 HIGH 的伤害面);
+ *  · `capture` 在场且不是字面 `"off"` ⇒ `code:"config.memory_capture_spelling"`。
+ *
+ * 这两形在本仓的 wire 面上**都到不了这里**,各有属主:
+ *  · 请求体侧 = 值闭包门 `singleMemberOffFieldIssue`(`src/request-value-closure.ts`;fresh 400 与 resume
+ *    重放共用的同一只)—— 到得了下游的 `memory`/`memoryCapture` 只可能是字面 `"off"` 或缺席;
+ *  · spec 侧 = 唯一铸点 {@link memorySpecForRequest}(本文件)—— 它恒产 `scopes: [scope, ...extras]`,
+ *    从不产单数 `scope`,`capture` 也只在声明为 `"off"` 时才铸。
+ *
+ * 所以这里抛 = **调用方没先过值闭包门**(手搓 spec、或绕过铸点直接喂一份 `TaskSpec.memory`),不是这一腿
+ * 的运行期异常,**不要在本函数里加吞异常的臂**:吞掉就退回「memory 静默整体关闭」,即上面那条报错原话
+ * 拒绝的那件事。要放宽/收紧值域,改上面两个属主。
  */
 export declare function memoryFaceMounted(memory: TaskSpec["memory"]): boolean;
 //# sourceMappingURL=memory-scope.d.ts.map

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -754,7 +754,9 @@ export declare class SqlCheckpointStore implements CheckpointStore {
      */
     peekScopeByToken(token: CheckpointToken): Promise<string | null | undefined>;
     peekPendingScope(sessionId: string, binding?: PendingRowBinding): Promise<string | null | undefined>;
-    /** Upsert the resume rebuild inputs for a session (written at SUBMIT when durable mode is on). */
+    /** Upsert the resume rebuild inputs for a session — written at SUBMIT (durable mode on) and, since S-433 F2,
+     *  once per resume leg at its CAS win point (`DriveResumeArgs.resumeCtx`). Unconditional per `session_id`:
+     *  the ordering fence lives at the CALLER's CAS win, not in a version column here. */
     putCtx(sessionId: string, ctx: unknown): Promise<void>;
     getCtx<T = unknown>(sessionId: string): Promise<T | null>;
     /**
@@ -763,7 +765,11 @@ export declare class SqlCheckpointStore implements CheckpointStore {
      *
      * The extra `task_active` guard closes a multi-gate window: between a resume's CAS (pending→resolved) and
      * the task hitting its NEXT gate (writing a new pending checkpoint), the session has no pending checkpoint —
-     * yet `putCtx` only stamps `updated_at_ms` at submit, so the ctx could be older than `cutoff` and was being
+     * yet `putCtx` stamps `updated_at_ms` at submit and — since S-433 F2 (server 7.86.0) — once more on EVERY
+     * resume leg, at the moment that leg wins the resume CAS (`DriveResumeArgs.resumeCtx`; before that fix only
+     * the plan approval's mode write-back re-stamped it, and it did so AFTER acceptance). Both extra writes only
+     * ever REFRESH the stamp, so they lengthen a ctx's life and touch none of the three guards — the direction is
+     * "keep it longer", never "reap it sooner". So the ctx could be older than `cutoff` and was being
      * reaped, making the next resume 409 ("resume context missing"). `task_active` holds the session lock for
      * the WHOLE submit→last-resume-complete span (running OR suspended), so excluding sessions with an active
      * claim keeps the ctx exactly as long as a run still needs it, while still GC'ing it once the run is terminal.

package/dist/plugins/store-contracts.d.ts

@@ -240,6 +240,29 @@ export declare function isUnsuccessfulRunStatus(status: RunRecord["status"]): bo
  * 动作(cancel 的恢复把手会 CAS-expire 一张 checkpoint);对一个本进程读不懂的状态,少动一次远好过错杀。
  */
 export declare function isParkedRunStatus(status: RunRecord["status"]): boolean;
+/**
+ * 「**证得出**这条 run 活在别的副本上」——「他副本」那一句话的**唯一判据**(S-381 收编;S-430 迁居)。
+ *
+ * 成案:这个合取式此前在四处**逐字手抄**(`http/routes/runs.ts` 的 steer 臂与 interrupt 臂、同文件
+ * `sendHandleMiss`、`http/routes/run-memory-capture.ts`),`POST /v1/sessions/:id/mcp/reconnect` 是第五处、`fleet/fleet-reconciler.ts` 是第六处 ——
+ * 而它的每一个合取项都是一条**被复审逐条挣出来的**纪律,不是随手的判空:
+ *  · {@link RunRecord.instanceId} 缺席(`null` / 建列之前的行 / 替身行的 `undefined`)= **不知道它在哪**,
+ *    不是「在别处」;
+ *  · `thisInstanceId` 缺席 = 本副本连自己是谁都说不上,更不能断言别人;
+ *  · 两者都在场且**不等**才够格说「他副本」(`markResuming` 认领后该列语义 = **当前持有副本**)。
+ * 抄一份 = 多一个写者;收成一只谓词之后,纪律改一次就处处同改。**`status` 不进本谓词**:
+ * `sendHandleMiss` 只对 `running` 行说这句话,而 steer 族在 park/终态两臂之后才走到这里 —— 各调用点
+ * 的前置臂不同族,合进来会让某一处悄悄改判。
+ *
+ * 🔴 **为什么住在这里而不是 `http/route-ctx.ts`**(S-430):`src/fleet/fleet-reconciler.ts` 是第六个手抄点,
+ * 而 `src/fleet/` 今天对 `src/http/` **零依赖**(边向恒是 http → fleet)。把消费方拉去 http 取一只纯谓词
+ * 会凭空造一条反向装载边;而本文件正是 {@link RunRecord} 与它的兄弟谓词({@link isTerminalRunStatus} /
+ * {@link isParkedRunStatus})的所在 —— 「关于 run 行的判词」本来就该在行的属主这里,http 与 fleet 都已经
+ * 依赖它。**无别名、无再导出**:旧拼法删干净,消费方的 tsc 红就是通知。
+ */
+export declare function runProvenElsewhere(run: {
+    instanceId?: string | null;
+}, thisInstanceId: string | undefined): boolean;
 /** One row of the GET /v1/sessions list (CC /resume picker): a DISTINCT session (sessionId) aggregated from its
  *  task_run rows — newest-first by last activity. The preview/status are the LATEST run's ("continue where I left
  *  off"); the counts/timestamps span the whole session. Owner included so a fleet-wide (ops) listing is attributable. */

package/dist/plugins/store-contracts.js

@@ -23,6 +23,9 @@ export function isUnsuccessfulRunStatus(status) {
 export function isParkedRunStatus(status) {
     return runStatusClassOf(status) === "parked";
 }
+export function runProvenElsewhere(run, thisInstanceId) {
+    return typeof run.instanceId === "string" && run.instanceId.length > 0 && thisInstanceId !== undefined && run.instanceId !== thisInstanceId;
+}
 export function mapBakeRow(r) {
     return {
         bakeId: r.bake_id,

package/dist/principal-jwt.d.ts

@@ -1,4 +1,5 @@
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
+import { type ApprovalEnvelope } from "./approval-hmac.js";
 /**
  * 验签允许的**时钟不一致容差**(秒)—— 本仓这条轴上的单一来源。
  *
@@ -47,6 +48,14 @@ export declare function verifyPrincipalJwt(token: string, keys: PrincipalJwtKey[
 /** 良构 Unicode(无孤立代理项)。`u` 旗下配对代理项是一个码点、不匹配 `\p{Surrogate}`;只有孤立的才命中。 */
 export declare function isWellFormedUnicode(s: string): boolean;
 export declare function editedPlanBinding(editedPlan: string): string;
+/**
+ * JWT `cnf.bnd` = **「这份身份凭据被签发去决哪一张卡」**(动作身份),故只哈希前三位。
+ *
+ * 🔴 **与 HMAC 信封的分工**(S-433 F1 立此,属主注在 `approval-hmac.ts` 顶):HMAC 绑的是**「决了什么」**
+ * —— `decision` / `reason` / `permissionModeAfter` 这些**会改变后果**的字段全在那一把里。所以「同一张卡上
+ * 把 approve 的档偷偷调宽」只由 HMAC 拦;本函数**刻意不跟着加位**:决定内容改了 `cnf.bnd` 不该变(否则
+ * 一份合法 JWT 会被绑死在一个它签发时还不知道的值上,而 `permissionModeAfter` 恰恰是决裁那一刻才定的)。
+ */
 export declare function approvalBnd(env: {
     sessionId: string;
     boundCallId?: string | null;
@@ -109,13 +118,12 @@ export declare function verifyDirectDoorProof(proof: {
     jwt?: string;
     mac?: string;
     kid?: string;
-}, envelope: {
-    sessionId: string;
-    boundCallId?: string | null;
-    boundInputHash?: string | null;
-    decision: string;
-    reason?: string | null;
-}, config: {
+}, 
+/** 🔴 **命名类型,不是结构等价的内联字面**(S-433 F1 [high] 的**根因**,验真后修):本位此前是一份手抄的
+ *  五字段内联形 —— 结构类型让**多带一个字段的调用方**照样编译通过,而下面那次手抄再把它**丢掉**,于是
+ *  `approval-hmac.ts` 上新增的签名位在这条唯一的真实验签链上**静默失效**,tsc 一个字都不响。
+ *  用 {@link ApprovalEnvelope} 之后,信封的形只有**一个**声明点,新增一位自动到达验签器。 */
+envelope: ApprovalEnvelope, config: {
     principalJwtPubkeys: PrincipalJwtKey[];
     principalJwtIss?: string;
     principalJwtAud?: string;

package/dist/principal-jwt.js

@@ -101,7 +101,7 @@ export function verifyDirectDoorProof(proof, envelope, config, opts) {
         return { ok: false, status: 401, errorCode: "principal_unbound", error: "principal token is not bound to this decision (cnf.bnd mismatch)" };
     if (!proof.mac)
         return { ok: false, status: 401, errorCode: "approval_mac_required", error: "direct door requires an approval MAC (X-Approval-Mac)" };
-    const ok = verifyApprovalHmac({ sessionId: envelope.sessionId, boundCallId: envelope.boundCallId ?? null, boundInputHash: envelope.boundInputHash ?? null, decision: envelope.decision, reason: envelope.reason ?? null }, proof.mac, proof.kid, config.approvalHmacKeys);
+    const ok = verifyApprovalHmac(envelope, proof.mac, proof.kid, config.approvalHmacKeys);
     if (!ok)
         return { ok: false, status: 401, errorCode: "approval_mac_invalid", error: "approval envelope MAC invalid" };
     return actionBinding

package/dist/read-face-posture.d.ts

@@ -23,8 +23,12 @@
  *
  * ## 定界
  * 本模块**只**管 `face` 一档。内建读拒表(`readDenyPatterns` / `readDenyBuiltinTiers` /
- * `readDenyBuiltinExclude`)一个字节不动 —— 放开容纳面不等于放开凭证/shell 历史/钱包那几档 deny,
- * 两者在 core 里是并列机制(deny 表在 open 面上照样拦)。core 的 `config.read_face_deployment_clamped`
+ * `readDenyBuiltinExclude`)一个字节不动 —— 放开容纳面不等于放开那几档 deny,两者在 core 里是**并列
+ * 机制**(有活行的 deny 表在 open 面上照样拦)。
+ * ⚠️ **但别把这句话读成「凭证/shell 历史/钱包那几档一直在岗」**:core 7.22.0([ref])起内建表的**缺省
+ * 选择是空** —— 一台没写 `READ_DENY_BUILTIN_TIERS` 的部署上,那张表**一行都不生效**(要老姿态就显式写
+ * `credentials,browser,wallet,agent-config`;运维面全文见 `docs/DEPLOY-PREREQS.md` 的 core 7.22.0 段)。
+ * 本模块的定界不变,变的是「并列的那一侧默认开着」这个**前提**。core 的 `config.read_face_deployment_clamped`
  * (只读挂载钳制)同样不受本件影响。
  */
 import { type PostureSource } from "./posture-source.js";

package/dist/task-settings.d.ts

@@ -70,6 +70,41 @@ export declare function coercePermissionMode(raw: unknown): SettingsPermissionMo
 /** 五模式闭集的**严格**读法([ref] ④:`/v1/capabilities?permissionMode=` 查询串用它 —— 读面对词表外的值 400,
  *  不走上面那条给 resume 重放留的 `default` 宽臂)。上面的宽读只是本函数外再包一层折叠,词表单点在此。 */
 export declare function coercePermissionModeStrict(raw: unknown): SettingsPermissionMode | undefined;
+/**
+ * S-433 —— 一份**被批准的计划**之后,这条会话继续用的 permission mode(`plan_review` 决裁体的
+ * `permissionModeAfter`)。core 的契约句是 `present-plan-tool.js`:「If the plan is approved, the run
+ * continues (and any read-only restriction is lifted)」—— 而 core 顶层 resume 把宿主的续跑配置**整体**
+ * 展开成新一段 spec、不继承停靠点的 `handsReadOnly` / `enablePlanMode`(`runtask.ts`),所以「松开」这
+ * 件事的属主在**本仓装配续跑配置的那一处**。批准者要说的正是「松到哪一档」。
+ *
+ * 🔴 **闭集为什么只有这两个词**:它是 CC `ExitPlanMode` 三选卡上那两张 Yes 卡(「Yes, and auto-accept
+ * edits」/「Yes, and manually approve edits」)的对位;`plan` 自己(= 不松开)由 `edit`/`reject` 两个
+ * 决裁表达,`bypassPermissions` / `auto` 不在这张卡上 —— 一个批准动作不该顺带把部署的 ask 面整个关掉。
+ *
+ * 🔴 **不手抄词表**:`satisfies readonly SettingsPermissionMode[]` 让「本表的成员必须仍是本仓受理的
+ * 模式词」成为**编译期**事实 —— 五词表某天改名/删词,这里就是红的,而不是静默留一个没人认的词。
+ */
+export declare const PLAN_APPROVE_PERMISSION_MODES_AFTER: readonly ["default", "acceptEdits"];
+/** {@link PLAN_APPROVE_PERMISSION_MODES_AFTER} 的类型形(值表单点,类型从值派生 —— 两处各写一份就会漂)。 */
+export type PlanApprovePermissionModeAfter = (typeof PLAN_APPROVE_PERMISSION_MODES_AFTER)[number];
+/** S-433 值闭集判据(wire 门用)。**宽臂一个都没有**:词表外的值 400 响亮拒 —— 这一位选的是批准之后
+ *  模型有没有手,把一个拼错的词折成任何一档都是安全轴上的静默降级([ref]「无静默 fail-open」)。 */
+export declare function isPlanApprovePermissionModeAfter(raw: unknown): raw is PlanApprovePermissionModeAfter;
+/**
+ * S-433 —— **一条已持久化的提交体的生效 permission mode**,单点。
+ *
+ * 它只是把 {@link effectivePermissionMode} 与「拿哪一份 settings 去问」这**一对**绑在一起:后者是
+ * `parseTaskSettings(body.settings)`(resume 重放共用的宽容解析层)。两处各写一遍这一对,就会在
+ * 「某天改成用别的 settings 去算生效模式」的那一拍静默分家 —— 而分家在这条轴上的形态是「wire 门说
+ * 这条任务不是只读起步、装配腿却按只读起步重建」,两个 4xx/行为各说各话,tsc 一声不响。
+ *
+ * ⚠️ 射程:**只管持久化体这一路**。首跑那一路的生效模式在 `boot/resolve-spec.ts` 单点算(它吃的是
+ * 场景折叠后的 settings),本函数刻意不去冒充那一处的属主。
+ */
+export declare function storedBodyPermissionMode(body: {
+    permissionMode?: unknown;
+    settings?: unknown;
+}): SettingsPermissionMode | undefined;
 /** L2 ultracode ([ref]): the effective `thinking` level given the explicit `reasoningEffort` and the ultracode
  *  preset. ultracode FLOORS at the "ultra" tier — core's single source `resolveReasoningProfile("ultra").thinking`
  *  (= "max"), never a hardcoded literal — so an explicit higher tier still wins (none exists above max today;

package/dist/task-settings.js

@@ -16,6 +16,13 @@ export function coercePermissionModeStrict(raw) {
         return raw;
     return undefined;
 }
+export const PLAN_APPROVE_PERMISSION_MODES_AFTER = ["default", "acceptEdits"];
+export function isPlanApprovePermissionModeAfter(raw) {
+    return PLAN_APPROVE_PERMISSION_MODES_AFTER.includes(raw);
+}
+export function storedBodyPermissionMode(body) {
+    return effectivePermissionMode(body, parseTaskSettings(body.settings).settings);
+}
 export function effectiveThinking(reasoningEffort, ultracode) {
     const explicit = isThinkingLevel(reasoningEffort) ? reasoningEffort : undefined;
     if (!ultracode)

package/dist/trace/core-keyset-guard.d.ts

@@ -17,7 +17,7 @@
  * ⑨⑩([ref],2026-08-31)把两个最大的 wire 面也纳入:TaskSpec 按「server 有无写点」记 Wired/Unwired,
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
-import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, WiringManifest, GateOutcome, GateDisposition, Settlement, PausedCause, WorkflowRun } from "@sema-agent/core";
+import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, WiringManifest, GateOutcome, GateDisposition, Settlement, PausedCause, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus } from "@sema-agent/core";
 import type { ToolApprovalFrame } from "../tool-approval.js";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。
  *  🔴 **导出**([ref] U1/U2):本仓「词表闭集,未处置成员=编译红」的钉法只许有**一个**形 ——
@@ -60,7 +60,7 @@ type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peer
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
 type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "writeProtection";
-type WiringSectionExcluded = "governance" | "configFingerprint" | "autoConsolidation";
+type WiringSectionExcluded = "governance" | "configFingerprint" | "autoConsolidation" | "readDeny";
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
 type WiringSection<K extends keyof WiringManifest> = NonNullable<WiringManifest[K]>;
@@ -103,6 +103,9 @@ type _GuardWiringRulesReverse = AssertAllKeysHandled<Exclude<WiringRulesHandled,
 type WiringWriteProtectionHandled = "targetView";
 type _GuardWiringWriteProtection = AssertAllKeysHandled<Exclude<keyof WiringSection<"writeProtection">, WiringWriteProtectionHandled>>;
 type _GuardWiringWriteProtectionReverse = AssertAllKeysHandled<Exclude<WiringWriteProtectionHandled, keyof WiringSection<"writeProtection">>>;
+type WiringReadDenyHandled = "builtinTiers";
+type _GuardWiringReadDeny = AssertAllKeysHandled<Exclude<keyof WiringSection<"readDeny">, WiringReadDenyHandled>>;
+type _GuardWiringReadDenyReverse = AssertAllKeysHandled<Exclude<WiringReadDenyHandled, keyof WiringSection<"readDeny">>>;
 type WiringAutoConsolidationHandled = "onRecommendation";
 type _GuardWiringAutoConsolidation = AssertAllKeysHandled<Exclude<keyof WiringSection<"autoConsolidation">, WiringAutoConsolidationHandled>>;
 type _GuardWiringAutoConsolidationReverse = AssertAllKeysHandled<Exclude<WiringAutoConsolidationHandled, keyof WiringSection<"autoConsolidation">>>;
@@ -164,6 +167,32 @@ type ParkRowWithheld = "token";
 type _GuardParkRow = AssertAllKeysHandled<Exclude<ParkRowKeys, ParkRowProjected | ParkRowWithheld>>;
 type _NoDoubleBookParkRow = AssertAllKeysHandled<Extract<ParkRowProjected, ParkRowWithheld>>;
 type _GuardParkRowReverse = AssertAllKeysHandled<Exclude<ParkRowProjected | ParkRowWithheld, ParkRowKeys>>;
+type ReadRootCandidateProjected = "dir" | "clearsThisAsk" | "covers";
+type _GuardReadRootCandidate = AssertAllKeysHandled<Exclude<keyof ReadRootGrantCandidate, ReadRootCandidateProjected>>;
+type _GuardReadRootCandidateReverse = AssertAllKeysHandled<Exclude<ReadRootCandidateProjected, keyof ReadRootGrantCandidate>>;
+type AskRiskAxes = NonNullable<AskRequest["riskAxes"]>;
+type RiskAxesProjected = "irreversible" | "egress";
+type _GuardRiskAxes = AssertAllKeysHandled<Exclude<keyof AskRiskAxes, RiskAxesProjected>>;
+type _GuardRiskAxesReverse = AssertAllKeysHandled<Exclude<RiskAxesProjected, keyof AskRiskAxes>>;
+type McpReconnectProjected = "server" | "prefix" | "toolCount" | "added" | "removed" | "outcome" | "tools" | "reason" | "status" | "listingIncomplete";
+type McpReconnectWithheld = "axes" | "dropped" | "warnings";
+type _GuardMcpReconnect = AssertAllKeysHandled<Exclude<keyof McpReconnectResult, McpReconnectProjected | McpReconnectWithheld>>;
+type _NoDoubleBookMcpReconnect = AssertAllKeysHandled<Extract<McpReconnectProjected, McpReconnectWithheld>>;
+type _GuardMcpReconnectReverse = AssertAllKeysHandled<Exclude<McpReconnectProjected | McpReconnectWithheld, keyof McpReconnectResult>>;
+type McpRedialStatusProjected = "name" | "status" | "errorCode" | "httpStatus" | "delivered" | "serverInfo" | "error" | "transportClosed";
+type McpRedialStatusWithheld = "toolNames";
+type _GuardMcpRedialStatus = AssertAllKeysHandled<Exclude<keyof McpServerStatus, McpRedialStatusProjected | McpRedialStatusWithheld>>;
+type _NoDoubleBookMcpRedialStatus = AssertAllKeysHandled<Extract<McpRedialStatusProjected, McpRedialStatusWithheld>>;
+type _GuardMcpRedialStatusReverse = AssertAllKeysHandled<Exclude<McpRedialStatusProjected | McpRedialStatusWithheld, keyof McpServerStatus>>;
+type McpPanelStatusProjected = "name" | "status" | "serverInfo" | "toolNames" | "error";
+type McpPanelStatusWithheld = "errorCode" | "httpStatus" | "delivered" | "transportClosed";
+type _GuardMcpPanelStatus = AssertAllKeysHandled<Exclude<keyof McpServerStatus, McpPanelStatusProjected | McpPanelStatusWithheld>>;
+type _NoDoubleBookMcpPanelStatus = AssertAllKeysHandled<Extract<McpPanelStatusProjected, McpPanelStatusWithheld>>;
+type _GuardMcpPanelStatusReverse = AssertAllKeysHandled<Exclude<McpPanelStatusProjected | McpPanelStatusWithheld, keyof McpServerStatus>>;
+type McpListingIncompleteKeys = keyof NonNullable<McpReconnectResult["listingIncomplete"]>;
+type McpListingIncompleteProjected = "reason" | "pages" | "budgetMs" | "error";
+type _GuardMcpListingIncomplete = AssertAllKeysHandled<Exclude<McpListingIncompleteKeys, McpListingIncompleteProjected>>;
+type _GuardMcpListingIncompleteReverse = AssertAllKeysHandled<Exclude<McpListingIncompleteProjected, McpListingIncompleteKeys>>;
 export type CoreKeysetGuards = [
     _GuardNotification,
     _GuardNotificationReverse,
@@ -188,6 +217,8 @@ export type CoreKeysetGuards = [
     _GuardWiringSections,
     _GuardWiringWriteProtection,
     _GuardWiringWriteProtectionReverse,
+    _GuardWiringReadDeny,
+    _GuardWiringReadDenyReverse,
     _GuardWiringAutoConsolidation,
     _GuardWiringAutoConsolidationReverse,
     _GuardWiringSectionsReverse,
@@ -242,7 +273,22 @@ export type CoreKeysetGuards = [
     _GuardWorkflowRunReverse,
     _GuardParkRow,
     _NoDoubleBookParkRow,
-    _GuardParkRowReverse
+    _GuardParkRowReverse,
+    _GuardReadRootCandidate,
+    _GuardReadRootCandidateReverse,
+    _GuardRiskAxes,
+    _GuardRiskAxesReverse,
+    _GuardMcpReconnect,
+    _NoDoubleBookMcpReconnect,
+    _GuardMcpReconnectReverse,
+    _GuardMcpRedialStatus,
+    _NoDoubleBookMcpRedialStatus,
+    _GuardMcpRedialStatusReverse,
+    _GuardMcpPanelStatus,
+    _NoDoubleBookMcpPanelStatus,
+    _GuardMcpPanelStatusReverse,
+    _GuardMcpListingIncomplete,
+    _GuardMcpListingIncompleteReverse
 ];
 export {};
 //# sourceMappingURL=core-keyset-guard.d.ts.map

package/dist/trace/project.d.ts

@@ -613,6 +613,18 @@ export declare function workspaceChangedEventData(ev: {
  *    并且它对调用方**本就不可观测**(整理跑在终端 harvest 之后、fire-and-forget、宿主侧),剥掉它不收走
  *    任何能力 —— 这正是 `writeProtection` 判据①**不成立**的那一格。
  *    ⚠️ **缺席 = 未武装**(core present-iff),不折 `false`、不读「未知」。
+ *    🔴 **S-403(7.85.0)起本条要连着 `core-keyset-guard.ts` ⑥b 判据②的补句读**:同一个事实在会话面
+ *    (`GET /v1/sessions/:id/memory-status` 的 `autoConsolidationArmed`)是可读的,而这一段仍然剥 ——
+ *    「一个事实一张脸」,两处同源、唯一读点。裁定正文在那一处,这里不抄第二份。
+ *  · `readDeny`(`{ builtinTiers: readonly string[] }`;core 7.22.0 [ref],S-417 提货件)—— **裁:operator
+ *    受众,租户面剥**,所以它**不在本构造器里**,在 {@link wiringManifestOperatorEventData}。四条判据逐字在
+ *    `core-keyset-guard.ts` ⑥b 的 `WiringSectionExcluded` 那一行(与 `governance` / `configFingerprint` /
+ *    `autoConsolidation` 同表同处,免得同一条裁定有两个写者)。一句话:它答的是**这台部署选了哪几档内置
+ *    敏感路径 deny 表**——一条部署治理面的**选择**,与 `writeProtection` 那种「这条腿手里有什么设施」的
+ *    自述不同族;而且它是本仓 env `READ_DENY_BUILTIN_TIERS` 的生效读出口,名表面归 operator(S-138)。
+ *    ⚠️ **缺席 = 没有内置行判这条腿**(core present-iff:实质激活至少一行才铸),**不是**「没有读被 deny
+ *    判」—— 部署自己的 `readDenyPatterns` 刻意不上报(模式文本是部署材料,不是枚举)。**空数组永不发出**
+ *    (「关」与「开到什么都不判」是同一个事实)⇒ 收到空数组按**坏 producer** 处置并留痕,见那里。
  * 未来 core 加一段而它没有 audience 标签时,**先在这里补一条裁定再决定挑不挑键** —— 段级完备性钉
  * (test/wiring-manifest-projection.test.ts)会在那一刻先把人拦下来 —— ⚠️ **但那条钉是夹具驱动的**:它只看
  * `deriveWiringManifest(EFFECTIVE_FACTS)` 真铸出来的段,facts 不带的可选段(147③ 的 `autoMode` 就是)它一格

package/dist/trace/project.js

@@ -554,6 +554,19 @@ export function wiringManifestOperatorEventData(ev) {
         ...(bool(g.memoryAdmission) !== undefined ? { memoryAdmission: g.memoryAdmission } : {}),
         ...(bool(g.retention) !== undefined ? { retention: g.retention } : {}),
     };
+    const readDeny = (() => {
+        if (m.readDeny === undefined)
+            return undefined;
+        const seg = sec(m.readDeny);
+        if (seg === undefined)
+            return dropProjectedFace("wiring_manifest.readDeny is not an object");
+        const tiers = seg.builtinTiers;
+        if (!Array.isArray(tiers) || tiers.length === 0)
+            return dropProjectedFace("wiring_manifest.readDeny.builtinTiers is not a non-empty array (core never emits an empty one)");
+        if (!tiers.every((t) => str(t) !== undefined))
+            return dropProjectedFace("wiring_manifest.readDeny.builtinTiers has a non-string / empty member");
+        return { builtinTiers: [...tiers] };
+    })();
     const autoConsolidation = (() => {
         if (m.autoConsolidation === undefined)
             return undefined;
@@ -567,6 +580,7 @@ export function wiringManifestOperatorEventData(ev) {
     return {
         ...tenant,
         ...(Object.keys(governance).length > 0 ? { governance } : {}),
+        ...(readDeny !== undefined ? { readDeny } : {}),
         ...(autoConsolidation !== undefined ? { autoConsolidation } : {}),
         ...(str(m.configFingerprint) !== undefined ? { configFingerprint: m.configFingerprint } : {}),
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.84.0",
+  "version": "7.86.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.21.1",
+    "@sema-agent/core": "7.22.0",
     "@sema-agent/settings-schema": "2.1.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",