@sema-agent/server 7.85.0 → 7.86.0

package/USAGE.md

@@ -408,6 +408,12 @@ MODEL_CASCADE_LADDER=deepseek-flash,deepseek-pro   # 目录里的模型名,cheap
   车道会尊重它(那条车道的定义就是"运维自己这台机、无容器边界")。所以「服务跑在 A 机、代码在 B 机」不成立
   —— 没有任何东西把 B 的路径映到 A。要么把服务(或 `run-local`)跑在放着文件的那台机器上,要么走容器车道
   (`e2b`/`k8s`/`local-docker`),那里的工作区是沙箱自己的,`cwd` 被忽略。
+- **读面(S-426 起)**:`GET /v1/capabilities` 的 `executionLane` 把本部署的车道广告成
+  `{provider:<REMOTE_EXEC 闭集词>, toolsOnThisHost:boolean}`(`REMOTE_EXEC` 未设 ⇒ `provider:"host"`)。
+  壳/客户端判「工具跑不跑在本机」**读这一位**,不要再从自己这一侧的 `REMOTE_EXEC` 猜 —— 连远端引擎时
+  那个 env 说的是**壳自己这台**的事。⚠️ 它是**文件系统同一性**位,**不是**权限位:`cwd` 兑不兑现仍由
+  `projectContext` / `callerCwd` 回答(那两位的判据多一条单用户约束,多租户 host 部署上两者会分叉)。
+  端点/凭据/镜像/`serial` 一个字都不上这条 wire,那些仍只在 operator 面 `GET /v1/config/catalog`。
 
 **workspace 浏览面 —— 已随整树快照纪元退役**
 - 旧四端点(list/tree/file/archive)恒 `501 capability.workspace_retired`,`capabilities.workspace`
@@ -1524,6 +1530,18 @@ GET /v1/capabilities?permissionMode=default
 **per-run 面**:本批不在 run 记录上加 per-run `autoMode` 座——引擎侧的武装结果 / 未武装原因(含只有引擎知道的那些;core 7.12.0 起熔断族已退役)
 将随 core 的状态座到货,届时 server 只投影不自算;此前 `armed` 是 server 侧三项可知判据的裁决。
 
+### 9.4b plan 模式(`permissionMode:"plan"`):批准一份计划时,顺带说「解到哪一档」(7.86.0 起)
+
+只读起步的任务把计划交给人之后停在 `plan_review` 门上。`POST /v1/assistant/tasks/:id/plan_review` 的
+`decision:"approve"` 可携 **`permissionModeAfter`**(闭集 `"default" | "acceptEdits"`,**缺席 ⇒ `"default"`**):
+`acceptEdits` = 继续跑时对自己工作目录内的写不再逐次征询,`default` = 有手但每次写照常征询;`edit` / `reject`
+的语义是重做计划,只读**原样保留**,在它们上送这一位是 `400`(词表外的值、以及本来就不是只读起步的任务送它,
+同样是 `400`)。解除会写回这条会话的续跑输入 —— 此后每一次挂起→续跑都沿用解除后的档,不回落只读。
+🔴 **这个体是闭集(7.86.0,S-438)**:受理集 = `decision` / `editedPlan` / `reason` / `permissionModeAfter` /
+`boundCallId` 五键,集外键(含定谳前的旧拼法 `nextPermissionMode`)**响亮拒** `400 request.body_shape` +
+机读两桶逐字点名,**不再静默丢** —— 与 `/v1/approvals/:id/decide` 同一只机器、同码同串。
+逐字契约见 `docs/ASSISTANT-WIRE-CONTRACT.md` §4c。
+
 ### 9.5 Web search:两车道优先级、per-request `settings.webSearch`、错误形
 
 **两车道,整段整取(不是逐键 merge)**:部署 env(`WEB_SEARCH_*`,§0)与 per-request `body.settings.webSearch`

package/dist/approval-hmac.d.ts

@@ -3,7 +3,7 @@ import type { ApprovalHmacKey } from "./auth-keys.js";
  * The canonical message an approval MAC signs — a fixed-order, JSON-escaped tuple so no field value (an id, a
  * hash, a free-text note) can ambiguate the boundary with the next (same discipline as the approvals-stream diff
  * key). 🔴 Bound to CLIENT-VISIBLE values only: `sessionId` (in the /decide URL) + `boundCallId`/`boundInputHash`
- * (surfaced by listPending) + `reason` (the caller's own body). It must NOT include the checkpointToken — that is
+ * (surfaced by listPending) + `reason` and `permissionModeAfter` (the caller's own body). It must NOT include the checkpointToken — that is
  * the unexposed resume credential the client can never see (it resumes by sessionId), so a checkpointToken-bound
  * message would be uncomputable by the signer.
  *
@@ -12,11 +12,24 @@ import type { ApprovalHmacKey } from "./auth-keys.js";
  * 被接管的客户端 —— 正是 HMAC 要防的风险模型)可以在操作员批准同一个动作的那次决定里,把落账理由换成
  * 别的:动作没变,**审计记录变了**。三方裁定纳入签名载荷,不留 `reasonUnsigned` 宽限代际(未上生产)。
  *
+ * ── 🔴 **两把绑定的分工**(S-433 F1 立此,别再把它们当成一回事)─────────────────────────────────
+ * `principal-jwt.ts` 的 `approvalBnd`(JWT `cnf.bnd`)只哈希**前三位** `[sessionId, boundCallId, boundInputHash]`
+ * —— 它绑的是**「哪一张卡」**(这份身份凭据被签发去决哪一次待决动作),所以决定内容改了它**不该**变。
+ * 本文件的 HMAC 信封绑的是**「决了什么」**—— 决定本身的每一个会改变后果的字段都在里面(`decision`、
+ * `reason`,以及 S-433 起的 `permissionModeAfter`)。⇒ 「同一张卡上把 approve 的档偷偷调宽」这件事,
+ * 结构上只有 HMAC 这一把拦得住;往 `cnf.bnd` 里加位既不解决它,还会把一份合法 JWT 绑死在一个它签发时
+ * 根本不知道的值上。**本次(S-433 F1)只动 HMAC 这一把,`approvalBnd` 一个字节不动。**
+ *
  * ── 🔴 字节构造规则(权威定义;跨仓签名器照此实现,docs/ASSISTANT-WIRE-CONTRACT.md §6.2 同源)──────────
  * 被 HMAC 的是下面这个字符串的 **UTF-8 字节**:
  *   1. **恒 5 元素、定序**的紧凑 JSON 数组(元素间**无空格**):
  *      `[sessionId, boundCallId|null, boundInputHash|null, decision, reason|null]`
  *      —— 恒定长度是刻意的:签名器里少一个"有 reason 才追加"的条件分支,就少一类跨实现漂移。
+ *      🔴 **唯一的例外是尾位**(S-433,server 7.86.0):`permissionModeAfter` **在场时**追加为第 6 位
+ *      `[…, permissionModeAfter]`,**缺席时一个字节都不追加**。之所以在这一位上接受那个条件分支:
+ *      它换来的是「不签这一位的既有签名器对不带本键的体照常验过」—— `reason` 入签那次是**全体签名器
+ *      同拍 BREAKING**(1.284.0),本次刻意不再来一次。带了本键而签名方没签 ⇒ MAC 不匹配 ⇒ 既有
+ *      `401 approval_mac_invalid`,不铸第二种拒绝形。
  *   2. 缺席 ⇒ `null`;**`""`(空串)是与 `null` 不同的被签值**(否则"把理由抹成空"不改变 MAC)。
  *   3. 字符串转义 = RFC 8259 最小集:`"`→`\"`、`\`→`\\`、U+0000–U+001F → `\n`/`\t`/`\uXXXX`。
  *   4. **非 ASCII 原样输出 UTF-8,不转 `\uXXXX`**。⚠️ Python 的 `json.dumps` 缺省 `ensure_ascii=True` 会踩
@@ -41,6 +54,20 @@ export interface ApprovalEnvelope {
     boundInputHash?: string | null;
     decision: string;
     reason?: string | null;
+    /**
+     * 🔴 **S-433 合并复审 F1 [high] —— 「凡改变续跑能做什么的决裁字段都在签名信封里」**(7.86.0,验真后修)。
+     *
+     * `plan_review` 的 `permissionModeAfter` 选的是**批准之后这条 run 有没有手**(`acceptEdits` = 工作目录内
+     * 的写不再逐次征询)。它铸下来时**没有**进签名载荷 ⇒ 一个能改写线上字节的中间人(反代 / 被接管的
+     * 客户端 —— 正是 HMAC 的风险模型)可以把操作员签的那次 `default` 批准原地改成 `acceptEdits`:动作没变、
+     * MAC 照过,**权限变了**。这与 `reason` 入签是同一条判据的更贵一格(那条改的是审计记录,这条改的是手)。
+     *
+     * 🔴 **尾位、按在场序列化**(编码规则见 {@link approvalHmacMessage}):键缺席 ⇒ 消息字节与 7.85.0 **逐字
+     * 节相同**,所以不签这一位的既有签名器(cli / BFF / deploy 夹具)对**不带本键的体**照常验过 —— 这一位
+     * 不是第二次 `reason` 式的 BREAKING。带了键而签名方没签 ⇒ MAC 不匹配 ⇒ 落既有的
+     * `401 approval_mac_invalid`,**不铸第二种拒绝形**(不加 400/401 串,不加「直连门直接拒收本键」的特判)。
+     */
+    permissionModeAfter?: string | null;
 }
 export declare function approvalHmacMessage(env: ApprovalEnvelope): string;
 /** 签名载荷里 `reason` 的字符上限。**拒**而不是截 —— 截断在这条路径上**结构上不可行**:服务端截过的字节

package/dist/approval-hmac.js

@@ -1,6 +1,7 @@
 import { createHmac, timingSafeEqual } from "node:crypto";
 export function approvalHmacMessage(env) {
-    return JSON.stringify([env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null, env.decision, env.reason ?? null]);
+    const head = [env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null, env.decision, env.reason ?? null];
+    return JSON.stringify(env.permissionModeAfter === undefined ? head : [...head, env.permissionModeAfter]);
 }
 export const MAX_APPROVAL_REASON_CHARS = 4_096;
 export function verifyApprovalHmac(env, mac, kid, keys) {

package/dist/capabilities/execution-lane.d.ts

@@ -0,0 +1,22 @@
+import type { RemoteExecProvider } from "../execution-lane-caps.js";
+export interface ExecutionLaneCapability {
+    /** 本部署的执行车道词(闭集 = {@link RemoteExecProvider};`REMOTE_EXEC` 未设 ⇒ `"host"`,见头注)。 */
+    readonly provider: RemoteExecProvider;
+    /** 工具跑的那台机器就是本进程这台吗(= server 盘上的绝对路径对模型的工具有没有意义)。
+     *  属主 = `task-cwd.ts` 的 {@link toolsRunOnThisHost},与 `skills[].baseDir` 的铸点同一只函数。 */
+    readonly toolsOnThisHost: boolean;
+}
+/**
+ * 部署席 → 消费端窄投影。形照 `projectWebSearchCapability` / `projectSqlEngineCapability`:
+ * **只 import 型**,不碰 config.ts,于是本模块是叶。
+ *
+ * 🔴 **唯一**写缺席折词的地方。`"host"` 这个字面量不入 `api-notice-text-freeze`:它是
+ * {@link RemoteExecProvider} 的成员,配置联合里那条臂改名 ⇒ 本行当场 tsc 红(S-382 对三个 provider 词
+ * 免入表的同一条理由 —— 会静默漂的只有**本仓自铸**的词,这里一个都没有)。
+ */
+export declare function projectExecutionLaneCapability(config: {
+    readonly remoteExec?: {
+        readonly provider: RemoteExecProvider;
+    } | undefined;
+}): ExecutionLaneCapability;
+//# sourceMappingURL=execution-lane.d.ts.map

package/dist/capabilities/execution-lane.js

@@ -0,0 +1,8 @@
+import { toolsRunOnThisHost } from "../task-cwd.js";
+export function projectExecutionLaneCapability(config) {
+    return {
+        provider: config.remoteExec?.provider ?? "host",
+        toolsOnThisHost: toolsRunOnThisHost(config),
+    };
+}
+//# sourceMappingURL=execution-lane.js.map

package/dist/capabilities/memory-notice.d.ts

@@ -38,7 +38,10 @@ export interface MemoryFaceFacts {
     /** 这一腿挂不挂记忆面 —— 由唯一属主 `memory-scope.ts` `memoryFaceMounted(spec.memory)` 算出(与 core `prepareMemory`
      *  同判:`normalizeMemorySpec(...)?.enabled === true`)。`false` = 引擎未接 / 多租户 dark / remote lane fail-closed /
      *  S-405 `memory:"off"`(键在场但 `enabled:false`)—— 殊途同归:core 不会 prepare 记忆,也就不会挂任何披露。
-     *  🔴 不再收 `TaskSpec.memory` 本体:按「键在不在场」判是 7.84.0 前的病(合并复审 车HF F1)。 */
+     *  🔴 不再收 `TaskSpec.memory` 本体:按「键在不在场」判是 7.84.0 前的病(合并复审 车HF F1)。
+     *  🔴 属主会**抛**(值闭包门没过的手搓 spec —— 单数 `scope` / 非 `"off"` 的 `capture`),理由与两个属主
+     *  的坐标逐字写在 `memory-scope.ts` 的 `memoryFaceMounted` 头注里;本判别式不接这条臂(接了就是在
+     *  披露轴上静默 fail-open)。 */
     memoryFaceMounted: boolean;
     /** 部署声明 `MEMORY_PERSISTENCE_CAPABLE`(三态)。`true` = operator 自证有推断看不见的持久通道
      *  (自定义 writer / MCP 记忆服务)⇒ 披露会变成假话,撤回;`false` = 强制披露;缺席 ⇒ 走推断。 */

package/dist/config-catalog.js

@@ -2,6 +2,7 @@ import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } fr
 import { THINKING_FORMATS } from "./model-compat.js";
 import { RESILIENCE_DEFAULTS } from "./config-types.js";
 import { webSearchConfigFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
+import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
 import { CENTER_READ_FACE_LIVE_KEYS } from "./config-center/read-face.js";
 export const CATALOG_VALUE_TYPES = ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
 export const CATALOG_TIMINGS = ["hot", "restart", "deploy", "inert"];
@@ -347,7 +348,7 @@ export const CONFIG_CATALOG = [
     r("READ_FACE", "orchestration", "enum", "READ 容纳面档位(env 逐键恒赢 center —— 部署主权表达)", { enumValues: ["open", "roots"], danger: SEC, derivedDefaultNote: "缺席 ⇒ 按 posture 派生(S-167):单用户 turnkey(REQUIRE_PRINCIPAL 未设)铸 open;多租户不铸键、core 默认 roots。生效来源见 GET /v1/diagnostics/wiring 的 readFace.source 四词", configKey: "readFace", center: cRead("face", "readFace") }),
     r("REAP_INTERVAL_SEC", "limitsHttp", "number", "reaper 周期(秒)", { staticDefault: "60", configKey: "reapIntervalSec" }),
     r("REAP_RUN_STALE_SEC", "limitsHttp", "number", "run 活性判陈旧阈(秒)", { staticDefault: "120", configKey: "runStaleSec", center: cLimits("runStaleSec") }),
-    r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: ["e2b", "k8s", "ssh", "adb", "host", "local-docker", "device"], danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
+    r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
     r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基;core ExecutionEnv.homeDir 座)", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user;k8s/local-docker/ssh/adb/device ⇒ 无(`~/` 规则 422 响亮拒)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
     r("REQUIRE_PRINCIPAL", "auth", "boolean", "多租户开关(posture 判别位:true ⇒ CC 能力族默认收紧)", { staticDefault: "false", danger: SEC, configKey: "requirePrincipal" }),
     r("RESOURCE_SUSPEND", "approval", "boolean", "durable 路径 opt-in core resourceSuspend(预算/preempt ⇒ 可恢复挂起)", { staticDefault: "false", configKey: "resourceSuspend" }),

package/dist/execution-lane-caps.d.ts

@@ -89,6 +89,19 @@ export declare function executionLaneCaps(lane: ExecutionLane): ExecutionLaneCap
 export declare function isExecutionLane(word: string): word is ExecutionLane;
 /** 车道普查全集(顺序 = 词表声明序;对账测试按它逐 lane 跑真判别式)。 */
 export declare const ALL_EXECUTION_LANES: readonly ExecutionLane[];
+/**
+ * `REMOTE_EXEC` **真能写下去的**那几个词(= {@link ALL_EXECUTION_LANES} 去掉 `in-process`:后者是
+ * 「没有 remoteExec」这个状态的名字,env 里写它没有意义)。
+ *
+ * 🔴 S-426 以点改面:此前 `config-catalog.ts` 的 `REMOTE_EXEC` 行把这张表**手抄**成一个
+ * `enumValues: ["e2b","k8s",…]` 字面量(字段静态型是 `readonly string[]`,与 {@link RemoteExecProvider}
+ * 零类型联系)。病形与 S-382 逮到的 `WEB_SEARCH_PROVIDER` 逐字同族:给
+ * `ServiceConfigFlat["remoteExec"]` 加一条 provider 臂(config-types.ts 里写着的下一条就是
+ * `remote-docker`),本文件的穷举 switch 与词表**会**编译红,而目录行不会 —— 于是运维在
+ * `GET /v1/config/catalog` 上读到的可写词集静默少一个,新车道成了「配了但目录说不认识」。
+ * 收成一只派生数组之后,目录行**就用它本人**(身份相等有钉),全仓只剩这一张表。
+ */
+export declare const REMOTE_EXEC_PROVIDER_WORDS: readonly RemoteExecProvider[];
 /**
  * `config.remoteExec?.provider` → 车道词。
  *

package/dist/execution-lane-caps.js

@@ -156,6 +156,7 @@ export function isExecutionLane(word) {
     return Object.hasOwn(EXECUTION_LANE_WORDS, word);
 }
 export const ALL_EXECUTION_LANES = Object.freeze(Object.keys(EXECUTION_LANE_WORDS).filter(isExecutionLane));
+export const REMOTE_EXEC_PROVIDER_WORDS = Object.freeze(ALL_EXECUTION_LANES.filter((lane) => lane !== "in-process"));
 export function executionLaneOf(provider) {
     if (provider === undefined)
         return "in-process";

package/dist/fleet/fleet-reconciler.js

@@ -1,6 +1,6 @@
 import { isTerminalWorkflowStatus } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
-import { isParkedRunStatus, isTerminalRunStatus } from "../plugins/store-contracts.js";
+import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../plugins/store-contracts.js";
 import { buildFleetWorkflowRow, fleetRunResiduals, runStatusToFleet } from "./fleet-bus.js";
 import { isTerminalWorkflowRowStatus } from "./fleet-terminal-window.js";
 export const FLEET_RECONCILE_INTERVAL_MS = 60_000;
@@ -169,7 +169,7 @@ export function createFleetReconciler(deps) {
                     tally.skippedParked++;
                     continue;
                 }
-                orphanExit(row, rec.instanceId !== null && rec.instanceId !== (deps.instanceId ?? null) ? "durable_running_other_replica" : "durable_running_no_local_leg");
+                orphanExit(row, runProvenElsewhere(rec, deps.instanceId) ? "durable_running_other_replica" : "durable_running_no_local_leg");
             }
             for (const row of snap.tasks) {
                 if (row.parentId === undefined || present.has(row.parentId))

package/dist/http/resume-legs.d.ts

@@ -16,6 +16,7 @@ import { type QuestionAnswer, type CheckpointToken } from "@sema-agent/core";
 import type { DecideBinding } from "./wire-types.js";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type HostDecision } from "../host-decision.js";
+import { type PlanApprovePermissionModeAfter } from "../task-settings.js";
 import type { RouteCtxBase, DriveResumeArgs } from "./route-ctx.js";
 import { type TrustedRunInternals } from "./durable-run-leg.js";
 import type { RunRegistry, RouteHelpers, RouteLegs } from "./route-ctx.js";
@@ -72,7 +73,7 @@ export declare function createResumeLegs(ctx: {
     }, acceptEarly?: boolean, decider?: {
         principal?: string;
         explicitOperator: boolean;
-    }) => Promise<{
+    }, permissionModeAfter?: PlanApprovePermissionModeAfter) => Promise<{
         status: number;
         body: object;
     }>;

package/dist/http/resume-legs.js

@@ -24,6 +24,7 @@ import { reasoningDeltaBytes, reasoningSegmentEventId } from "../trace/model-seg
 import { errorText } from "../observability/err-text.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
+import { storedBodyPermissionMode } from "../task-settings.js";
 import { acceptedResumingReceipt } from "./route-ctx.js";
 import { mintAndDriveDurableRun } from "./durable-run-leg.js";
 import { createSessionsLocal } from "./routes/sessions.js";
@@ -320,7 +321,7 @@ export function createResumeLegs(ctx) {
             hostDecision,
         };
         const verifyRounds = verifyRoundsFromBody(ctx.body);
-        const driven = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
+        const driven = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
         noteLateSettleIfAccepted(driven);
         return driven;
     }
@@ -353,7 +354,11 @@ export function createResumeLegs(ctx) {
     }
     async function driveResumeLeg(args, onAccepted) {
         const resumeLegStartedAt = Date.now();
-        const { runner: legRunner, token, sessionId, principal, fleetScope, taskConfig, resumeObjective, outcome, verifyRounds } = args;
+        const { runner: legRunner, token, sessionId, principal, fleetScope, taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx } = args;
+        const commitResumeCtx = () => deps.checkpointStore.putCtx(resumeCtx.sessionId, resumeCtx.ctx).catch((e) => {
+            deps.metrics?.inc("resume_ctx_not_persisted_total");
+            deps.logger?.warn?.("resume_ctx_not_persisted", { sessionId: resumeCtx.sessionId, gate: outcome.gate, error: errorText(e), note: "this continuation runs with the body it was given; the durable rebuild input still holds the PREVIOUS body, so the NEXT continuation of this session rebuilds from that one (never wider than this leg's)" });
+        });
         const legKey = createHash("sha256").update(String(token)).digest("hex");
         const streamApprovalOn = resolveStreamApprovalGate({
             toolApprovalEnabled: Boolean(deps.toolApproval),
@@ -539,6 +544,7 @@ export function createResumeLegs(ctx) {
                     };
                     resumeLegLive = true;
                     const vr = await resumeWithVerification(legRunner, token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, resumeObjective, verifyRounds, verifyInternals);
+                    await commitResumeCtx();
                     let safe = stripResumeToken(vr);
                     const vrNested = nestedPauseOf(vr.terminal);
                     const reParkStatus = nestedParkStatusOf(vr);
@@ -663,6 +669,7 @@ export function createResumeLegs(ctx) {
                             }
                             : {}),
                     });
+                    await commitResumeCtx();
                     resumeStreamRef = stream;
                     if (taskId)
                         steerableRuns.set(taskId, stream);
@@ -1026,7 +1033,7 @@ export function createResumeLegs(ctx) {
         const { spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth);
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         const verifyRounds = verifyRoundsFromBody(ctx.body);
-        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, verifyRounds, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
     }
     async function startFreshHostTurn(sessionId, objective, principal, req, trustedInternals, runId) {
         const cs = deps.checkpointStore;
@@ -1139,6 +1146,7 @@ export function createResumeLegs(ctx) {
             resumeObjective,
             outcome: { gate: "wake", ...(message !== undefined ? { message: { text: message, trusted } } : {}) },
             verifyRounds: undefined,
+            resumeCtx: { sessionId, ctx },
             mintFreshRun: { source: "wake" },
             ...(engineNotices.length > 0 ? { engineNotices } : {}),
             ...(acceptEarly === true ? { acceptEarly: true } : {}),
@@ -1147,7 +1155,7 @@ export function createResumeLegs(ctx) {
             ...(ownerLeaseAdmittedFor !== undefined && auth.principal === ownerLeaseAdmittedFor ? { ownerLeaseAdmitted: true } : {}),
         });
     }
-    async function resumePlanReview(sessionId, decision, editedPlan, reason, req, log, acceptEarly, decider) {
+    async function resumePlanReview(sessionId, decision, editedPlan, reason, req, log, acceptEarly, decider, permissionModeAfter) {
         const cs = deps.checkpointStore;
         const log404 = (r) => deps.logger?.info?.("decide_404", {
             reason: r,
@@ -1208,7 +1216,13 @@ export function createResumeLegs(ctx) {
         if (!ctx)
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const { spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth);
+        const effMode = storedBodyPermissionMode(ctx.body);
+        if (permissionModeAfter !== undefined && effMode !== "plan") {
+            throw new Error("resumePlanReview: permissionModeAfter was passed for a task that was not submitted with permissionMode \"plan\" — the caller must refuse this before any state changes (see the plan_review route's pre-nonce gate)");
+        }
+        const approvedMode = decision === "approve" && effMode === "plan" ? (permissionModeAfter ?? "default") : undefined;
+        const resumeBody = approvedMode === undefined ? ctx.body : { ...ctx.body, permissionMode: approvedMode };
+        const { spec, engineNotices } = await resolveResumeSpec(resumeBody, req, auth);
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         const verifyRounds = verifyRoundsFromBody(ctx.body);
         const outcome = {
@@ -1217,7 +1231,8 @@ export function createResumeLegs(ctx) {
             ...(editedPlan !== undefined ? { editedPlan } : {}),
             ...(reason ? { reason } : {}),
         };
-        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+        const out = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx: { sessionId, ctx: { ...ctx, body: resumeBody } }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+        return out;
     }
     const routeCtxBase = {
         deps,

package/dist/http/route-ctx.d.ts

@@ -23,6 +23,7 @@ import type { IdempotencyCache } from "./idempotency.js";
 import type { ImagesLocal } from "./routes/images.js";
 import type { SessionsLocal } from "./routes/sessions.js";
 import type { SessionSyncLocal } from "./routes/session-sync.js";
+import type { PlanApprovePermissionModeAfter } from "../task-settings.js";
 import type { VerifyRoundsSpec } from "./verify-rounds.js";
 /** 跨域可变状态 = lens1 §C2 实测的那 8 条「运行期登记簿」,一个对象。 */
 export interface RunRegistry {
@@ -127,9 +128,55 @@ export interface PreparedTaskSubmission {
      *  经 `pending` 一起投(投递单点仍是那一只注册助手,不新开第二条机制)。缺席 = 本次装配没铸下任何通告。 */
     engineNotices?: readonly EngineNotice[];
 }
+/**
+ * 一条会话的**续跑重建输入**(`checkpoint_ctx` 的行体)—— 提交腿写一次,续跑腿读它重建 spec。
+ *
+ * S-433 F2 起命名化(此前是五处结构等价的内联字面 `{ body: TaskRequestBody; memoryScope?: string }`):
+ * 它同时是 {@link DriveResumeArgs.resumeCtx} 的形,而那一位是**写回**口 —— 读形与写形是同一件东西这句话
+ * 得由类型说,不能靠五处手抄碰巧一致。
+ */
+export interface CheckpointCtx {
+    body: TaskRequestBody;
+    /** 提交时这条会话绑定的记忆域(重建 `RequestAuth` 用);缺席 = 没有记忆面。 */
+    memoryScope?: string;
+}
 /** B4①(命名化):`driveResumeIntoRunLog` 的入参形(resume 家族共用)——原为 9 成员内联匿名对象。 */
 export interface DriveResumeArgs {
     token: CheckpointToken;
+    /**
+     * 🔴 **S-433 合并复审 F2 [high] —— 「本次续跑真正用的那个体」,由本腿在赢下 CAS 之后写回耐久层**
+     * (验真后修;必填 —— `driveResumeIntoRunLog` 今天恰有**四个**调用点:legacy `/decide`(`resumeCheckpoint`)、
+     * `resumePreempted`、`resumeWake`、`resumePlanReview`,四条一视同仁)。
+     *
+     * 病(修前):`resumePlanReview` 在 `driveResumeIntoRunLog` **受理(2xx)之后**才 `putCtx(sessionId,
+     * {...ctx, body})`,而 `ctx` 是请求**开头** `getCtx` 读到的那一份,两个店的 `putCtx` 又都是按
+     * `session_id` **无条件 upsert**(`checkpoint-store-sql.ts` / `local-checkpoint-store.ts`)。受理点之后
+     * 本腿已经可以跑完并 `setTerminal` 释放 `task_active` —— 别的副本随即 `createRun` + 写一份**新的** ctx,
+     * 然后这条迟到的写把它整只盖掉。那是一条**跨副本的丢写**,而被盖掉的恰恰是权限模式。
+     *
+     * 修法(单一写者,栅栏 = CAS 赢点,不引版本号/不加特判):写点移进 `driveResumeLeg`,落在
+     * `resumeStream` / `resumeWithVerification` **解析之后**(core 的 pre-CAS 守卫 + 原子 CAS 已经赢了)、
+     * 本腿驱终局之前。此时 park 行仍攥着 `task_active`,在本腿 `setTerminal` 之前**谁也建不了新 run** ⇒
+     * 写与释放天然串行;输掉 CAS 的决裁在 `resumeStream` 处就 reject,**永远到不了写点**(「先写回则输家
+     * 放宽」这个顾虑同时成立)。
+     *
+     * 不变量(规则变小,四条驱动腿一视同仁):**`ctx.body` 恒等于最近一次赢得 CAS 的续跑实际用的体**。
+     * 体没被改写的腿传**原 ctx** —— 同内容 upsert 幂等,不需要「只有 plan_review 才写」这条特判。
+     *
+     * 🔴 `sessionId` 自带一位:写回的键**恒是读进来的那一个**(各腿的 `sessionId` 形参,**不是**
+     * `cp.sessionId`)—— 读写不同键会写出一条谁也读不回来的行。
+     *
+     * 🔴 写失败**响亮但不致命**(codex r1 两条 [high] 验真后定):core 的 `resumeStream` 是 **EAGER** 的 ——
+     * 写点这一拍 run 已经在执行,裸抛会把一条活腿判成 failed + 释放 claim 而执行还在继续。⇒ 一个臂、
+     * 四条腿同守:计数 `resume_ctx_not_persisted_total` + 一行 warn,本次续跑照常。方向论证(不是 [ref] 的
+     * 静默放宽):写失败 ⇒ 耐久体保持**上一次**的值,而这四条腿里只有 `resumePlanReview` 改写这个体、
+     * 且只会**放宽** ⇒ 落盘的恒不比本次续跑更宽。旧的 `plan_approve_mode_not_persisted`(plan 专用)随本批删除,
+     * 由上面这只家族级的取代。全文见 `resume-legs.ts` 的 `commitResumeCtx` 顶注。
+     */
+    resumeCtx: {
+        sessionId: string;
+        ctx: CheckpointCtx;
+    };
     /** [ref]:续跑腿的执行 Runner。resume 会用同一条 resolveSpec 重解析场景,故与首跑选同一只 —— 否则
      *  一次续跑就把手带 band 重新 mount 回来(收窄只在首跑成立 = 没成立)。 */
     runner: Runner;
@@ -354,7 +401,10 @@ export interface RouteLegs {
     decider?: {
         principal?: string;
         explicitOperator: boolean;
-    }): Promise<{
+    }, 
+    /** S-433:批准之后这条会话继续用的 permission mode(闭集 `PLAN_APPROVE_PERMISSION_MODES_AFTER`;只在 `approve`
+     *  上有意义,缺席 ⇒ `"default"`)。语义与判据的唯一属主 = `resume-legs.ts` 的同名形参顶注。 */
+    permissionModeAfter?: PlanApprovePermissionModeAfter): Promise<{
         status: number;
         body: object;
     }>;
@@ -549,22 +599,6 @@ export declare function acceptedResumingReceipt(taskId: string, sessionId: strin
     status: number;
     body: object;
 };
-/**
- * 「**证得出**这条 run 活在别的副本上」——「他副本」那一句话的**唯一判据**(S-381 收编)。
- *
- * 成案:这个合取式此前在四处**逐字手抄**(`routes/runs.ts` 的 steer 臂与 interrupt 臂、同文件
- * `sendHandleMiss`、`routes/run-memory-capture.ts`),第五处就要随 `POST /v1/sessions/:id/mcp/reconnect`
- * 出现 —— 而它的每一个合取项都是一条**被复审逐条挣出来的**纪律,不是随手的判空:
- *  · `run.instanceId` 缺席(`null` / 建列之前的行 / 替身行的 `undefined`)= **不知道它在哪**,不是「在别处」;
- *  · `thisInstanceId` 缺席 = 本副本连自己是谁都说不上,更不能断言别人;
- *  · 两者都在场且**不等**才够格说「他副本」(`markResuming` 认领后该列语义 = **当前持有副本**)。
- * 抄第五份 = 第五个写者;收成一只谓词之后,纪律改一次就四处同改。**`status` 不进本谓词**:
- * `sendHandleMiss` 只对 `running` 行说这句话,而 steer 族在 park/终态两臂之后才走到这里 —— 各调用点
- * 的前置臂不同族,合进来会让某一处悄悄改判。
- */
-export declare function runProvenElsewhere(run: {
-    instanceId?: string | null;
-}, thisInstanceId: string | undefined): boolean;
 export declare const RUN_NOT_FOUND_MESSAGE = "run not found \u2014 the id belongs to no run in this deployment's run store (a run from another server process, or an in-memory store that did not survive a restart, is not visible here)";
 /** [ref] 前缀=域判别子既成契约:a\* 与 wa\* 形 id 给 TaskOutput/journal 指路;其余给 {@link RUN_NOT_FOUND_MESSAGE}。 */
 export declare function runNotFoundMessage(id: string): string;

package/dist/http/route-ctx.js

@@ -24,9 +24,6 @@ export const ROUTE_METHOD_ORDER = ["GET", "POST", "PUT", "DELETE"];
 export function acceptedResumingReceipt(taskId, sessionId) {
     return { status: 200, body: { taskId, sessionId, status: "resuming", bindingEnforced: true } };
 }
-export function runProvenElsewhere(run, thisInstanceId) {
-    return typeof run.instanceId === "string" && run.instanceId.length > 0 && thisInstanceId !== undefined && run.instanceId !== thisInstanceId;
-}
 export const RUN_NOT_FOUND_MESSAGE = "run not found — the id belongs to no run in this deployment's run store (a run from another server process, or an in-memory store that did not survive a restart, is not visible here)";
 export function runNotFoundMessage(id) {
     const aStar = /^(?:a|wa)[0-9a-f]{4,}$/i.test(id);

package/dist/http/routes/approvals-assistant.d.ts

@@ -16,6 +16,17 @@ import { type KeyClosureIssue } from "../../request-key-closure.js";
  * 的两种兑现方式:**门只站在人**(或客户端)**现写的那份字节**上。
  */
 export declare function decideBodyKeyIssue(raw: unknown): KeyClosureIssue | null;
+/**
+ * FRESH 决裁面的**顶层**键闭集裁决:受理集之外的键 ⇒ 返回拒体(调用方 400 `request.body_shape`);
+ * 全部受理 ⇒ `null`。判据边界与三个孪生门(`taskBodyKeyIssue` / `taskSettingsKeyIssue` /
+ * {@link decideBodyKeyIssue})逐字同一条:**只判键名**(值形校验归各自既有的门,本门零抢话);体本身
+ * 非对象 ⇒ 本门不判(留给「body must be { decision … }」那道根形门,免得同一个体被两句话抢答)。
+ *
+ * 🔴 **重放不额外过门**,也不需要 —— 逐字同 {@link decideBodyKeyIssue} 的同名段:本腿的反重放是
+ * 一次性 nonce(S-280),它守的是**同一份现写的字节**;而续跑重建读的是盘上的体、走 `resolveSpec` 的
+ * 宽容层 ⇒ 4xx 砖不到任何存量挂起的任务。**门只站在人(或客户端)现写的那份字节上**。
+ */
+export declare function planReviewBodyKeyIssue(raw: unknown): KeyClosureIssue | null;
 /**
  * S-342 —— 「空串的理由 = 没有理由 = 这是一次**裸拒**」。这条语义只适用于**本仓自铸**的那一个域。
  *

package/dist/http/routes/approvals-assistant.js

@@ -7,6 +7,7 @@ import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
 import { MAX_APPROVAL_REASON_CHARS } from "../../approval-hmac.js";
+import { PLAN_APPROVE_PERMISSION_MODES_AFTER, isPlanApprovePermissionModeAfter, storedBodyPermissionMode } from "../../task-settings.js";
 import { MAX_APPROVAL_NONCE_CHARS } from "../../plugins/approval-nonce-store.js";
 import { redactedPreview, redactSecrets } from "../../trace/redact.js";
 import { redactRiskDescriptor } from "../../observability/run-terminal-log.js";
@@ -46,6 +47,35 @@ export function decideBodyKeyIssue(raw) {
         unsupportedKeys: buckets.unsupported.slice(0, MAX_KEY_ECHO),
     };
 }
+const PLAN_REVIEW_BODY_DECLARED_KEYS = [
+    "boundCallId", "decision", "editedPlan", "permissionModeAfter", "reason",
+];
+const ACCEPTED_PLAN_REVIEW_BODY = new Set(PLAN_REVIEW_BODY_DECLARED_KEYS);
+const UNSUPPORTED_PLAN_REVIEW_BODY = new Set([
+    "answer", "boundInputHash", "checkpointToken", "permissionMode", "remember", "sessionId", "taskId", "updatedInput",
+]);
+export function planReviewBodyKeyIssue(raw) {
+    if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const buckets = { unknown: [], unsupported: [] };
+    scanKeyClosure(raw, "", ACCEPTED_PLAN_REVIEW_BODY, UNSUPPORTED_PLAN_REVIEW_BODY, buckets);
+    if (buckets.unknown.length === 0 && buckets.unsupported.length === 0)
+        return null;
+    buckets.unknown.sort();
+    buckets.unsupported.sort();
+    const parts = [
+        ...(buckets.unknown.length > 0 ? [keyClosureClause(buckets.unknown, "unknown (not a plan-review-request key — check the spelling)")] : []),
+        ...(buckets.unsupported.length > 0 ? [keyClosureClause(buckets.unsupported, "unsupported (a sibling approval door's field, a submit-body key, or a path parameter — never read from this body)")] : []),
+    ];
+    return {
+        message: `body: unrecognized top-level key(s) — refused rather than dropped, because a dropped key reads as "in effect" to the caller ` +
+            `(a misspelled \`permissionModeAfter\` silently leaves this task read-only after you approved its plan). ` +
+            `${parts.join("; ")}. ` +
+            `Accepted: ${[...ACCEPTED_PLAN_REVIEW_BODY].sort().join(",")}`,
+        unknownKeys: buckets.unknown.slice(0, MAX_KEY_ECHO),
+        unsupportedKeys: buckets.unsupported.slice(0, MAX_KEY_ECHO),
+    };
+}
 export function decisionReasonOf(body) {
     return typeof body.reason === "string" && body.reason !== "" ? body.reason : undefined;
 }
@@ -133,7 +163,7 @@ async function decideIdempotentReplay(cs, args) {
 export async function handleApprovalsAssistant(req, res, match, ctx) {
     const { deps } = ctx;
     const { preemptableRuns } = ctx.registry;
-    const { readJson, rateLimited, quotaExceeded } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, safeDecode } = ctx.helpers;
     const { resumeCheckpoint, resumePreempted, resumePlanReview } = ctx.legs;
     {
         const cs = deps.checkpointStore;
@@ -164,13 +194,9 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     sendError(res, 501, "capability.store_required", "approval exemptions need a store backend");
                     return;
                 }
-                let exSessionId;
-                let exToolName;
-                try {
-                    exSessionId = decodeURIComponent(match.params.sessionId);
-                    exToolName = match.params.tool !== undefined ? decodeURIComponent(match.params.tool) : undefined;
-                }
-                catch {
+                const exSessionId = safeDecode(match.params.sessionId);
+                const exToolName = match.params.tool !== undefined ? safeDecode(match.params.tool) : undefined;
+                if (exSessionId === null || exToolName === null) {
                     sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
                     return;
                 }
@@ -365,9 +391,16 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "edit" ? "edit" : body?.decision === "reject" ? "reject" : undefined;
             if (!decision) {
-                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'edit' | 'reject', editedPlan?, reason? }");
+                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'edit' | 'reject', editedPlan?, reason?, permissionModeAfter? }");
                 return;
             }
+            {
+                const keyIssue = planReviewBodyKeyIssue(body);
+                if (keyIssue) {
+                    sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
+                    return;
+                }
+            }
             if (decision === "edit" && (typeof body.editedPlan !== "string" || body.editedPlan.length === 0)) {
                 sendError(res, 400, "request.field_conflict", "decision 'edit' requires a non-empty editedPlan (the operator's revised plan)");
                 return;
@@ -380,6 +413,14 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "request.field_conflict", `editedPlan is only valid with decision 'edit' (got '${decision}')`);
                 return;
             }
+            if (body.permissionModeAfter !== undefined && !isPlanApprovePermissionModeAfter(body.permissionModeAfter)) {
+                sendError(res, 400, "request.field_invalid", `permissionModeAfter must be one of ${PLAN_APPROVE_PERMISSION_MODES_AFTER.map((m) => JSON.stringify(m)).join(" | ")} when present (the permission mode this task continues in once the plan is approved; absent = "default", which keeps asking before each write)`);
+                return;
+            }
+            if (decision !== "approve" && body.permissionModeAfter !== undefined) {
+                sendError(res, 400, "request.field_conflict", `permissionModeAfter is only valid with decision 'approve' (got '${decision}')`);
+                return;
+            }
             if (body.reason !== undefined && typeof body.reason !== "string") {
                 sendError(res, 400, "request.field_invalid", "reason must be a string");
                 return;
@@ -423,7 +464,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
                 const storeNowMs = await store.nowMs();
                 const hdr = (n) => { const h = req.headers[n]; return Array.isArray(h) ? h[0] : h; };
-                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, { sessionId: run.sessionId, boundCallId: planNonce ?? null, boundInputHash: decision === "edit" ? editedPlanBinding(body.editedPlan) : null, decision, reason: typeof body.reason === "string" ? body.reason : null }, deps.config, { actionBinding: false, nowSec: Math.floor(storeNowMs / 1000) });
+                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, { sessionId: run.sessionId, boundCallId: planNonce ?? null, boundInputHash: decision === "edit" ? editedPlanBinding(body.editedPlan) : null, decision, reason: typeof body.reason === "string" ? body.reason : null, ...(isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? { permissionModeAfter: body.permissionModeAfter } : {}) }, deps.config, { actionBinding: false, nowSec: Math.floor(storeNowMs / 1000) });
                 if (!proof.ok) {
                     sendError(res, proof.status, proof.errorCode, proof.error);
                     return;
@@ -438,6 +479,13 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
+            if (body.permissionModeAfter !== undefined) {
+                const storedCtx = await deps.checkpointStore?.getCtx(run.sessionId).catch(() => null);
+                if (storedCtx?.body !== undefined && storedBodyPermissionMode(storedCtx.body) !== "plan") {
+                    sendError(res, 400, "request.field_conflict", "permissionModeAfter does not apply to this task: it was not submitted with permissionMode \"plan\", so approving the plan lifts no read-only restriction");
+                    return;
+                }
+            }
             if (singleUse !== undefined) {
                 const { proof: onceOnly, store } = singleUse;
                 const fresh = await store.consume(run.sessionId, onceOnly.nonce, onceOnly.acceptedBeforeMs);
@@ -450,18 +498,15 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
             }
-            const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, { taskId, principalPresent: principal !== undefined }, true, { principal: deciderPrincipal, explicitOperator });
+            const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, { taskId, principalPresent: principal !== undefined }, true, { principal: deciderPrincipal, explicitOperator }, isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined);
             sendResumeOutcome(res, out, deps.logger);
             return;
         }
         if (match.decl.id === "approval-decide") {
             if (rateLimited(req, res) || quotaExceeded(req, res))
                 return;
-            let sessionId;
-            try {
-                sessionId = decodeURIComponent(match.params.sessionId);
-            }
-            catch {
+            const sessionId = safeDecode(match.params.sessionId);
+            if (sessionId === null) {
                 sendError(res, 400, "request.path_malformed", "malformed approval id (invalid percent-encoding)");
                 return;
             }