@sema-agent/server 7.85.0 → 7.86.0

package/dist/http/routes/capabilities.js

@@ -13,6 +13,7 @@ import { projectMemoryEngineCapability } from "../../memory-posture.js";
 import { projectWriteProtectionCapability } from "../../write-protection.js";
 import { projectSqlEngineCapability } from "../../sql-engine-posture.js";
 import { projectWebSearchCapability } from "../../plugins/web-search.js";
+import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
 import { workflowModelAllowlistFor, selfOrchestrationDenial } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
@@ -126,6 +127,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 interactiveTools: true,
                 projectContext: cwdHonored(deps.config),
                 callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
+                executionLane: projectExecutionLaneCapability(deps.config),
                 mcpInjection: mcpInjectionHonored(deps.config),
                 a2a: true,
                 a2aInjection: a2aInjectionHonored(deps.config),

package/dist/http/routes/images.js

@@ -41,7 +41,7 @@ const RUNNER_ERROR_CODES = new Set(["band-conflict", "duplicate", "disk", "timeo
 const SANDBOX_BASE_PROFILE = "sandbox-base";
 export async function handleImages(req, res, match, ctx) {
     const { deps } = ctx;
-    const { readJson } = ctx.helpers;
+    const { readJson, safeDecode } = ctx.helpers;
     const { source } = ctx.req;
     const { bakeSubmitLimiter } = ctx.local.images;
     if (deps.imageBakes && isBakeRouteId(match.decl.id)) {
@@ -128,7 +128,11 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
             }
-            const bakeId = decodeURIComponent(match.params.bakeId);
+            const bakeId = safeDecode(match.params.bakeId);
+            if (bakeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const bake = await bakes.getBake(bakeId);
             if (!bake) {
                 sendError(res, 404, "not_found.bake", "bake not found");
@@ -142,7 +146,11 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
             }
-            const bakeId = decodeURIComponent(match.params.bakeId);
+            const bakeId = safeDecode(match.params.bakeId);
+            if (bakeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const bake = await bakes.getBake(bakeId);
             if (!bake) {
                 sendError(res, 404, "not_found.bake", "bake not found");
@@ -178,7 +186,11 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 403, "auth.bake_runner_only", "bake-runner only");
                 return;
             }
-            const bakeId = decodeURIComponent(match.params.bakeId);
+            const bakeId = safeDecode(match.params.bakeId);
+            if (bakeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const body = (await readJson(req));
             const runnerId = typeof body.runnerId === "string" && body.runnerId.length > 0 ? body.runnerId : (principal ?? source ?? cfg.runnerPrincipal);
             const claimed = await bakes.claimBake(bakeId, runnerId, cfg.leaseMs);
@@ -194,7 +206,11 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 403, "auth.bake_runner_only", "bake-runner only");
                 return;
             }
-            const bakeId = decodeURIComponent(match.params.bakeId);
+            const bakeId = safeDecode(match.params.bakeId);
+            if (bakeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const bake = await bakes.getBake(bakeId);
             if (!bake) {
                 sendError(res, 404, "not_found.bake", "bake not found");
@@ -238,7 +254,11 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
             }
-            const bakeId = decodeURIComponent(match.params.bakeId);
+            const bakeId = safeDecode(match.params.bakeId);
+            if (bakeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const bake = await bakes.getBake(bakeId);
             if (!bake) {
                 sendError(res, 404, "not_found.bake", "bake not found");
@@ -335,7 +355,12 @@ export async function handleImages(req, res, match, ctx) {
             return;
         }
         if (match.decl.id === "image-by-digest") {
-            const entry = await idx.getByDigest(decodeURIComponent(match.params.digest));
+            const digest = safeDecode(match.params.digest);
+            if (digest === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
+            const entry = await idx.getByDigest(digest);
             if (!entry || (!viewer.operator && entry.visibility === "tenant" && entry.tenantId !== viewer.tenantId)) {
                 sendError(res, 404, "not_found.image", "not found");
                 return;
@@ -344,7 +369,12 @@ export async function handleImages(req, res, match, ctx) {
             return;
         }
         if (match.decl.id === "image-by-profile") {
-            const entry = await idx.latestPublished(decodeURIComponent(match.params.profile), viewer);
+            const profile = safeDecode(match.params.profile);
+            if (profile === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
+            const entry = await idx.latestPublished(profile, viewer);
             if (!entry) {
                 sendError(res, 404, "not_found.image", "not found");
                 return;

package/dist/http/routes/mcp-reconnect.d.ts

@@ -33,7 +33,7 @@
  * 路径是 session,动词挂在 **run 句柄**上 ⇒ 会话属主门(`sessionStorage.ownerOf`,未知与他人**同码同串**
  * 404 无 oracle,与 `POST /v1/sessions/:id/notify` 逐字同形)→ `getActiveTaskId` 取本会话的活 run →
  * `steerableRuns` 取本副本活流。非 live 的四臂一码 409 `steering.not_running`,判据取词表属主
- * (`isParkedRunStatus` / `isTerminalRunStatus`)与 `runProvenElsewhere`(四处手抄已收编成一只谓词)。
+ * (`isParkedRunStatus` / `isTerminalRunStatus`)与 `runProvenElsewhere`(手抄已收编成一只谓词,S-430 起同住 `plugins/store-contracts.ts`)。
  * 显式 operator 可重拨任何租户的会话(监督动作,与 notify / steer 同臂;**不是** bare `isOperator`)。
  *
  * ── 计费/门 ─────────────────────────────────────────────────────────────────────────────────────

package/dist/http/routes/mcp-reconnect.js

@@ -1,9 +1,9 @@
 import { z } from "zod";
-import { isParkedRunStatus, isTerminalRunStatus } from "../../plugins/store-contracts.js";
+import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
-import { runProvenElsewhere } from "../route-ctx.js";
+import {} from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 const BodySchema = z.object({ server: z.string().min(1).max(190) }).strict();
 const NEUTRALIZED_TEXT_MAX = 200;

package/dist/http/routes/memory-policy.js

@@ -63,7 +63,7 @@ function sendScopeGateRefusal(res, gate) {
 }
 export async function handleMemoryPolicy(req, res, match, ctx) {
     const { deps } = ctx;
-    const { readJson } = ctx.helpers;
+    const { readJson, safeDecode } = ctx.helpers;
     switch (match.decl.id) {
         case "memory-export": {
             const principal = gatedPrincipal(req, deps.config);
@@ -135,11 +135,8 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
                 sendError(res, 501, "capability.memory_store_required", "memory sync requires a DB memory backend (MEMORY_ENGINE_BACKEND=pg|tidb)");
                 return;
             }
-            let scope;
-            try {
-                scope = decodeURIComponent(match.params.scope);
-            }
-            catch {
+            const scope = safeDecode(match.params.scope);
+            if (scope === null) {
                 sendError(res, 400, "memory_sync_invalid_scope", "malformed percent-encoding in :scope");
                 return;
             }

package/dist/http/routes/notify-wake.js

@@ -6,7 +6,7 @@ import { assertNever } from "../route-ctx.js";
 export async function handleNotifyWake(req, res, match, ctx) {
     const { deps } = ctx;
     const { steerableRuns } = ctx.registry;
-    const { readJson, rateLimited, quotaExceeded, leaseDenied } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, leaseDenied, safeDecode } = ctx.helpers;
     const { resumeWake } = ctx.legs;
     switch (match.decl.id) {
         case "session-notify": {
@@ -17,7 +17,11 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            const notifySession = decodeURIComponent(match.params.sessionId);
+            const notifySession = safeDecode(match.params.sessionId);
+            if (notifySession === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
             let nb;
             try {
                 nb = (await readJson(req));
@@ -111,7 +115,11 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            const wakeSession = decodeURIComponent(match.params.sessionId);
+            const wakeSession = safeDecode(match.params.sessionId);
+            if (wakeSession === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
             let wakeBody;
             try {
                 wakeBody = (await readJson(req));

package/dist/http/routes/run-memory-capture.js

@@ -1,8 +1,8 @@
 import { z } from "zod";
-import { isParkedRunStatus, isTerminalRunStatus } from "../../plugins/store-contracts.js";
+import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
-import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage, runProvenElsewhere } from "../route-ctx.js";
+import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 const BodySchema = z.object({ reason: z.string().min(1).max(500).optional() }).strict();
 export async function handleRunMemoryCapture(req, res, match, ctx) {
@@ -31,10 +31,8 @@ export async function handleRunMemoryCapture(req, res, match, ctx) {
                 sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
                 return;
             }
-            if (run.owner !== null && run.owner !== principal) {
-                sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+            if (!ctx.helpers.runOwnerOk(req, res, run.owner))
                 return;
-            }
             const live = ctx.registry.steerableRuns.get(taskId);
             if (live) {
                 try {

package/dist/http/routes/runs.js

@@ -3,7 +3,7 @@ import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactH
 import { isModelTextLedgerEventType } from "../../trace/ledger-events.js";
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer } from "@sema-agent/core";
-import { isTerminalRunStatus, isParkedRunStatus } from "../../plugins/store-contracts.js";
+import { isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-sql.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { HttpError, verifiedPrincipal, isUuidV7, encodeCheckpointScope } from "../../security.js";
@@ -27,7 +27,7 @@ import { headerStr, gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } f
 import { ActorAssertionWire } from "@sema-agent/settings-schema";
 import { assertNever } from "../route-ctx.js";
 import { mintAndDriveDurableRun } from "../durable-run-leg.js";
-import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage, runProvenElsewhere } from "../route-ctx.js";
+import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 const ASK_PARKING_RETRY_AFTER_SEC = 2;
 const ASK_ACTOR_LABEL_MAX = 256;
@@ -64,7 +64,8 @@ export function projectDecisionActor(raw) {
     const parsed = AskDecisionActorSchema.safeParse(raw);
     return parsed.success ? parsed.data : undefined;
 }
-async function subagentReadGate(req, res, deps, runId, search) {
+async function subagentReadGate(req, res, ctx, runId, search) {
+    const { deps } = ctx;
     const principal = gatedPrincipal(req, deps.config);
     if (deps.config.requirePrincipal && principal === undefined) {
         sendPrincipalRefusal(res, req, deps.config);
@@ -72,10 +73,13 @@ async function subagentReadGate(req, res, deps, runId, search) {
     }
     const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
     const run = await deps.runStore.getRun(runId);
-    if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
+    if (!run) {
         sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
         return null;
     }
+    if (!trusted && !ctx.helpers.runOwnerOk(req, res, run.owner)) {
+        return null;
+    }
     const callerSession = new URLSearchParams(search).get("session");
     if (!trusted && run.sessionId && callerSession !== run.sessionId) {
         sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
@@ -429,10 +433,8 @@ export async function handleRuns(req, res, match, ctx) {
             sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
             return;
         }
-        if (!trusted && run.owner !== null && run.owner !== principal) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+        if (!trusted && !runOwnerOk(req, res, run.owner))
             return;
-        }
         if (!runSessionAcceptOk(req, res, run, "run.steer"))
             return;
         let parkQueueFull;
@@ -714,10 +716,8 @@ export async function handleRuns(req, res, match, ctx) {
             sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
             return;
         }
-        if (!trusted && run.owner !== null && run.owner !== principal) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+        if (!trusted && !runOwnerOk(req, res, run.owner))
             return;
-        }
         if (!runSessionAcceptOk(req, res, run, "run.interrupt"))
             return;
         const sendInterruptNotRunning = (error) => sendError(res, 409, "steering.not_running", error);
@@ -812,10 +812,8 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-        if (!operator && run.owner !== null && run.owner !== principal) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+        if (!operator && !runOwnerOk(req, res, run.owner))
             return;
-        }
         if (!runSessionAcceptOk(req, res, run, "run.compact"))
             return;
         let compactBody;
@@ -894,10 +892,8 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-        if (!operator && run.owner !== null && run.owner !== principal) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+        if (!operator && !runOwnerOk(req, res, run.owner))
             return;
-        }
         if (!runSessionAcceptOk(req, res, run, "run.detach"))
             return;
         const live = steerableRuns.get(taskId);
@@ -913,7 +909,7 @@ export async function handleRuns(req, res, match, ctx) {
 }
 export async function handleRunVerbs(req, res, match, ctx) {
     const { deps } = ctx;
-    const { readJson, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, safeDecode, runSessionAcceptOk } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, safeDecode, runOwnerOk, runSessionAcceptOk } = ctx.helpers;
     if (match.decl.id === "run-subagent-output") {
         if (!deps.runStore || !deps.subagentTaskOutput) {
             sendError(res, 501, "capability.run_store_required", "subagent output reads require the run store");
@@ -925,7 +921,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 400, "request.path_malformed", "malformed subagent path (invalid percent-encoding)");
             return;
         }
-        const gated = await subagentReadGate(req, res, deps, runId, match.search);
+        const gated = await subagentReadGate(req, res, ctx, runId, match.search);
         if (!gated)
             return;
         const { run } = gated;
@@ -950,7 +946,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 400, "request.path_malformed", "malformed subagent path (invalid percent-encoding)");
             return;
         }
-        const gatedTail = await subagentReadGate(req, res, deps, runId, match.search);
+        const gatedTail = await subagentReadGate(req, res, ctx, runId, match.search);
         if (!gatedTail)
             return;
         const { run } = gatedTail;
@@ -1015,7 +1011,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 400, "request.path_malformed", "malformed task path (invalid percent-encoding)");
             return;
         }
-        const gatedB = await subagentReadGate(req, res, deps, runId, match.search);
+        const gatedB = await subagentReadGate(req, res, ctx, runId, match.search);
         if (!gatedB)
             return;
         const { run } = gatedB;
@@ -1113,10 +1109,12 @@ export async function handleRunVerbs(req, res, match, ctx) {
         }
         const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
         const run = await deps.runStore.getRun(runId);
-        if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
+        if (!run) {
             sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
             return;
         }
+        if (!trusted && !runOwnerOk(req, res, run.owner))
+            return;
         if (!runSessionAcceptOk(req, res, run, `subagent.${verb}`))
             return;
         const send409 = (errorCode, error) => sendError(res, 409, errorCode, error);

package/dist/http/routes/sessions.js

@@ -219,7 +219,11 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_store_required", "session head probe requires a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
-            const headSession = decodeURIComponent(match.params.sessionId);
+            const headSession = safeDecode(match.params.sessionId);
+            if (headSession === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
             const getHead = deps.sessionStorage?.getHead?.bind(deps.sessionStorage);
             let owner;
             let leafId;
@@ -262,7 +266,11 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_store_required", "session events require a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
-            const evSession = decodeURIComponent(match.params.sessionId);
+            const evSession = safeDecode(match.params.sessionId);
+            if (evSession === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
             if (sse.sseConnections >= (deps.sessionEventsMaxConnections ?? 256)) {
                 res.setHeader("retry-after", "5");
                 sendError(res, 503, "state.sse_connection_cap", "session-events connection cap reached — fall back to /head polling");

package/dist/http/routes/shared-memory.js

@@ -90,7 +90,11 @@ export async function handleSharedMemory(req, res, match, ctx) {
         }
         case "shared-memory-store-documents":
         case "shared-memory-store-document": {
-            const storeId = decodeURIComponent(match.params.store);
+            const storeId = ctx.helpers.safeDecode(match.params.store);
+            if (storeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const query = new URLSearchParams(match.search);
             const snapshot = await bindSnapshot(req, res, ctx);
             if (!snapshot)

package/dist/memory-scope.d.ts

@@ -221,6 +221,22 @@ declarations?: {
  * `normalizeMemorySpec(spec)?.enabled === true`。S-405 之后 `memory:"off"` 铸的是「键在场 + `enabled:false`」(保留事实),
  * 任何按「键在不在场」判挂没挂的读者从那一天起都读错(改前 `memory-notice` 正是那样,把无记忆面的披露一起吞掉)。
  * 消费方拿本函数的布尔,不拿 `spec.memory` 自己判。
+ *
+ * ⚠️ **本函数会抛,而「抛」本身就是一条判据**(S-424 补注)。`normalizeMemorySpec` 对两形直接 throw
+ * (亲核安装态 core 7.22.0 `dist/core/memory.js:367-372` 与 `:373-385`):
+ *  · 单数 `scope` 键在场 ⇒ `code:"config.memory_scope_spelling"`(core 已删的旧拼写;它的报错原话
+ *    是「Refusing to start with memory silently off」—— 静默关闭正是那次 HIGH 的伤害面);
+ *  · `capture` 在场且不是字面 `"off"` ⇒ `code:"config.memory_capture_spelling"`。
+ *
+ * 这两形在本仓的 wire 面上**都到不了这里**,各有属主:
+ *  · 请求体侧 = 值闭包门 `singleMemberOffFieldIssue`(`src/request-value-closure.ts`;fresh 400 与 resume
+ *    重放共用的同一只)—— 到得了下游的 `memory`/`memoryCapture` 只可能是字面 `"off"` 或缺席;
+ *  · spec 侧 = 唯一铸点 {@link memorySpecForRequest}(本文件)—— 它恒产 `scopes: [scope, ...extras]`,
+ *    从不产单数 `scope`,`capture` 也只在声明为 `"off"` 时才铸。
+ *
+ * 所以这里抛 = **调用方没先过值闭包门**(手搓 spec、或绕过铸点直接喂一份 `TaskSpec.memory`),不是这一腿
+ * 的运行期异常,**不要在本函数里加吞异常的臂**:吞掉就退回「memory 静默整体关闭」,即上面那条报错原话
+ * 拒绝的那件事。要放宽/收紧值域,改上面两个属主。
  */
 export declare function memoryFaceMounted(memory: TaskSpec["memory"]): boolean;
 //# sourceMappingURL=memory-scope.d.ts.map

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -754,7 +754,9 @@ export declare class SqlCheckpointStore implements CheckpointStore {
      */
     peekScopeByToken(token: CheckpointToken): Promise<string | null | undefined>;
     peekPendingScope(sessionId: string, binding?: PendingRowBinding): Promise<string | null | undefined>;
-    /** Upsert the resume rebuild inputs for a session (written at SUBMIT when durable mode is on). */
+    /** Upsert the resume rebuild inputs for a session — written at SUBMIT (durable mode on) and, since S-433 F2,
+     *  once per resume leg at its CAS win point (`DriveResumeArgs.resumeCtx`). Unconditional per `session_id`:
+     *  the ordering fence lives at the CALLER's CAS win, not in a version column here. */
     putCtx(sessionId: string, ctx: unknown): Promise<void>;
     getCtx<T = unknown>(sessionId: string): Promise<T | null>;
     /**
@@ -763,7 +765,11 @@ export declare class SqlCheckpointStore implements CheckpointStore {
      *
      * The extra `task_active` guard closes a multi-gate window: between a resume's CAS (pending→resolved) and
      * the task hitting its NEXT gate (writing a new pending checkpoint), the session has no pending checkpoint —
-     * yet `putCtx` only stamps `updated_at_ms` at submit, so the ctx could be older than `cutoff` and was being
+     * yet `putCtx` stamps `updated_at_ms` at submit and — since S-433 F2 (server 7.86.0) — once more on EVERY
+     * resume leg, at the moment that leg wins the resume CAS (`DriveResumeArgs.resumeCtx`; before that fix only
+     * the plan approval's mode write-back re-stamped it, and it did so AFTER acceptance). Both extra writes only
+     * ever REFRESH the stamp, so they lengthen a ctx's life and touch none of the three guards — the direction is
+     * "keep it longer", never "reap it sooner". So the ctx could be older than `cutoff` and was being
      * reaped, making the next resume 409 ("resume context missing"). `task_active` holds the session lock for
      * the WHOLE submit→last-resume-complete span (running OR suspended), so excluding sessions with an active
      * claim keeps the ctx exactly as long as a run still needs it, while still GC'ing it once the run is terminal.

package/dist/plugins/store-contracts.d.ts

@@ -240,6 +240,29 @@ export declare function isUnsuccessfulRunStatus(status: RunRecord["status"]): bo
  * 动作(cancel 的恢复把手会 CAS-expire 一张 checkpoint);对一个本进程读不懂的状态,少动一次远好过错杀。
  */
 export declare function isParkedRunStatus(status: RunRecord["status"]): boolean;
+/**
+ * 「**证得出**这条 run 活在别的副本上」——「他副本」那一句话的**唯一判据**(S-381 收编;S-430 迁居)。
+ *
+ * 成案:这个合取式此前在四处**逐字手抄**(`http/routes/runs.ts` 的 steer 臂与 interrupt 臂、同文件
+ * `sendHandleMiss`、`http/routes/run-memory-capture.ts`),`POST /v1/sessions/:id/mcp/reconnect` 是第五处、`fleet/fleet-reconciler.ts` 是第六处 ——
+ * 而它的每一个合取项都是一条**被复审逐条挣出来的**纪律,不是随手的判空:
+ *  · {@link RunRecord.instanceId} 缺席(`null` / 建列之前的行 / 替身行的 `undefined`)= **不知道它在哪**,
+ *    不是「在别处」;
+ *  · `thisInstanceId` 缺席 = 本副本连自己是谁都说不上,更不能断言别人;
+ *  · 两者都在场且**不等**才够格说「他副本」(`markResuming` 认领后该列语义 = **当前持有副本**)。
+ * 抄一份 = 多一个写者;收成一只谓词之后,纪律改一次就处处同改。**`status` 不进本谓词**:
+ * `sendHandleMiss` 只对 `running` 行说这句话,而 steer 族在 park/终态两臂之后才走到这里 —— 各调用点
+ * 的前置臂不同族,合进来会让某一处悄悄改判。
+ *
+ * 🔴 **为什么住在这里而不是 `http/route-ctx.ts`**(S-430):`src/fleet/fleet-reconciler.ts` 是第六个手抄点,
+ * 而 `src/fleet/` 今天对 `src/http/` **零依赖**(边向恒是 http → fleet)。把消费方拉去 http 取一只纯谓词
+ * 会凭空造一条反向装载边;而本文件正是 {@link RunRecord} 与它的兄弟谓词({@link isTerminalRunStatus} /
+ * {@link isParkedRunStatus})的所在 —— 「关于 run 行的判词」本来就该在行的属主这里,http 与 fleet 都已经
+ * 依赖它。**无别名、无再导出**:旧拼法删干净,消费方的 tsc 红就是通知。
+ */
+export declare function runProvenElsewhere(run: {
+    instanceId?: string | null;
+}, thisInstanceId: string | undefined): boolean;
 /** One row of the GET /v1/sessions list (CC /resume picker): a DISTINCT session (sessionId) aggregated from its
  *  task_run rows — newest-first by last activity. The preview/status are the LATEST run's ("continue where I left
  *  off"); the counts/timestamps span the whole session. Owner included so a fleet-wide (ops) listing is attributable. */

package/dist/plugins/store-contracts.js

@@ -23,6 +23,9 @@ export function isUnsuccessfulRunStatus(status) {
 export function isParkedRunStatus(status) {
     return runStatusClassOf(status) === "parked";
 }
+export function runProvenElsewhere(run, thisInstanceId) {
+    return typeof run.instanceId === "string" && run.instanceId.length > 0 && thisInstanceId !== undefined && run.instanceId !== thisInstanceId;
+}
 export function mapBakeRow(r) {
     return {
         bakeId: r.bake_id,

package/dist/principal-jwt.d.ts

@@ -1,4 +1,5 @@
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
+import { type ApprovalEnvelope } from "./approval-hmac.js";
 /**
  * 验签允许的**时钟不一致容差**(秒)—— 本仓这条轴上的单一来源。
  *
@@ -47,6 +48,14 @@ export declare function verifyPrincipalJwt(token: string, keys: PrincipalJwtKey[
 /** 良构 Unicode(无孤立代理项)。`u` 旗下配对代理项是一个码点、不匹配 `\p{Surrogate}`;只有孤立的才命中。 */
 export declare function isWellFormedUnicode(s: string): boolean;
 export declare function editedPlanBinding(editedPlan: string): string;
+/**
+ * JWT `cnf.bnd` = **「这份身份凭据被签发去决哪一张卡」**(动作身份),故只哈希前三位。
+ *
+ * 🔴 **与 HMAC 信封的分工**(S-433 F1 立此,属主注在 `approval-hmac.ts` 顶):HMAC 绑的是**「决了什么」**
+ * —— `decision` / `reason` / `permissionModeAfter` 这些**会改变后果**的字段全在那一把里。所以「同一张卡上
+ * 把 approve 的档偷偷调宽」只由 HMAC 拦;本函数**刻意不跟着加位**:决定内容改了 `cnf.bnd` 不该变(否则
+ * 一份合法 JWT 会被绑死在一个它签发时还不知道的值上,而 `permissionModeAfter` 恰恰是决裁那一刻才定的)。
+ */
 export declare function approvalBnd(env: {
     sessionId: string;
     boundCallId?: string | null;
@@ -109,13 +118,12 @@ export declare function verifyDirectDoorProof(proof: {
     jwt?: string;
     mac?: string;
     kid?: string;
-}, envelope: {
-    sessionId: string;
-    boundCallId?: string | null;
-    boundInputHash?: string | null;
-    decision: string;
-    reason?: string | null;
-}, config: {
+}, 
+/** 🔴 **命名类型,不是结构等价的内联字面**(S-433 F1 [high] 的**根因**,验真后修):本位此前是一份手抄的
+ *  五字段内联形 —— 结构类型让**多带一个字段的调用方**照样编译通过,而下面那次手抄再把它**丢掉**,于是
+ *  `approval-hmac.ts` 上新增的签名位在这条唯一的真实验签链上**静默失效**,tsc 一个字都不响。
+ *  用 {@link ApprovalEnvelope} 之后,信封的形只有**一个**声明点,新增一位自动到达验签器。 */
+envelope: ApprovalEnvelope, config: {
     principalJwtPubkeys: PrincipalJwtKey[];
     principalJwtIss?: string;
     principalJwtAud?: string;

package/dist/principal-jwt.js

@@ -101,7 +101,7 @@ export function verifyDirectDoorProof(proof, envelope, config, opts) {
         return { ok: false, status: 401, errorCode: "principal_unbound", error: "principal token is not bound to this decision (cnf.bnd mismatch)" };
     if (!proof.mac)
         return { ok: false, status: 401, errorCode: "approval_mac_required", error: "direct door requires an approval MAC (X-Approval-Mac)" };
-    const ok = verifyApprovalHmac({ sessionId: envelope.sessionId, boundCallId: envelope.boundCallId ?? null, boundInputHash: envelope.boundInputHash ?? null, decision: envelope.decision, reason: envelope.reason ?? null }, proof.mac, proof.kid, config.approvalHmacKeys);
+    const ok = verifyApprovalHmac(envelope, proof.mac, proof.kid, config.approvalHmacKeys);
     if (!ok)
         return { ok: false, status: 401, errorCode: "approval_mac_invalid", error: "approval envelope MAC invalid" };
     return actionBinding

package/dist/task-settings.d.ts

@@ -70,6 +70,41 @@ export declare function coercePermissionMode(raw: unknown): SettingsPermissionMo
 /** 五模式闭集的**严格**读法([ref] ④:`/v1/capabilities?permissionMode=` 查询串用它 —— 读面对词表外的值 400,
  *  不走上面那条给 resume 重放留的 `default` 宽臂)。上面的宽读只是本函数外再包一层折叠,词表单点在此。 */
 export declare function coercePermissionModeStrict(raw: unknown): SettingsPermissionMode | undefined;
+/**
+ * S-433 —— 一份**被批准的计划**之后,这条会话继续用的 permission mode(`plan_review` 决裁体的
+ * `permissionModeAfter`)。core 的契约句是 `present-plan-tool.js`:「If the plan is approved, the run
+ * continues (and any read-only restriction is lifted)」—— 而 core 顶层 resume 把宿主的续跑配置**整体**
+ * 展开成新一段 spec、不继承停靠点的 `handsReadOnly` / `enablePlanMode`(`runtask.ts`),所以「松开」这
+ * 件事的属主在**本仓装配续跑配置的那一处**。批准者要说的正是「松到哪一档」。
+ *
+ * 🔴 **闭集为什么只有这两个词**:它是 CC `ExitPlanMode` 三选卡上那两张 Yes 卡(「Yes, and auto-accept
+ * edits」/「Yes, and manually approve edits」)的对位;`plan` 自己(= 不松开)由 `edit`/`reject` 两个
+ * 决裁表达,`bypassPermissions` / `auto` 不在这张卡上 —— 一个批准动作不该顺带把部署的 ask 面整个关掉。
+ *
+ * 🔴 **不手抄词表**:`satisfies readonly SettingsPermissionMode[]` 让「本表的成员必须仍是本仓受理的
+ * 模式词」成为**编译期**事实 —— 五词表某天改名/删词,这里就是红的,而不是静默留一个没人认的词。
+ */
+export declare const PLAN_APPROVE_PERMISSION_MODES_AFTER: readonly ["default", "acceptEdits"];
+/** {@link PLAN_APPROVE_PERMISSION_MODES_AFTER} 的类型形(值表单点,类型从值派生 —— 两处各写一份就会漂)。 */
+export type PlanApprovePermissionModeAfter = (typeof PLAN_APPROVE_PERMISSION_MODES_AFTER)[number];
+/** S-433 值闭集判据(wire 门用)。**宽臂一个都没有**:词表外的值 400 响亮拒 —— 这一位选的是批准之后
+ *  模型有没有手,把一个拼错的词折成任何一档都是安全轴上的静默降级([ref]「无静默 fail-open」)。 */
+export declare function isPlanApprovePermissionModeAfter(raw: unknown): raw is PlanApprovePermissionModeAfter;
+/**
+ * S-433 —— **一条已持久化的提交体的生效 permission mode**,单点。
+ *
+ * 它只是把 {@link effectivePermissionMode} 与「拿哪一份 settings 去问」这**一对**绑在一起:后者是
+ * `parseTaskSettings(body.settings)`(resume 重放共用的宽容解析层)。两处各写一遍这一对,就会在
+ * 「某天改成用别的 settings 去算生效模式」的那一拍静默分家 —— 而分家在这条轴上的形态是「wire 门说
+ * 这条任务不是只读起步、装配腿却按只读起步重建」,两个 4xx/行为各说各话,tsc 一声不响。
+ *
+ * ⚠️ 射程:**只管持久化体这一路**。首跑那一路的生效模式在 `boot/resolve-spec.ts` 单点算(它吃的是
+ * 场景折叠后的 settings),本函数刻意不去冒充那一处的属主。
+ */
+export declare function storedBodyPermissionMode(body: {
+    permissionMode?: unknown;
+    settings?: unknown;
+}): SettingsPermissionMode | undefined;
 /** L2 ultracode ([ref]): the effective `thinking` level given the explicit `reasoningEffort` and the ultracode
  *  preset. ultracode FLOORS at the "ultra" tier — core's single source `resolveReasoningProfile("ultra").thinking`
  *  (= "max"), never a hardcoded literal — so an explicit higher tier still wins (none exists above max today;

package/dist/task-settings.js

@@ -16,6 +16,13 @@ export function coercePermissionModeStrict(raw) {
         return raw;
     return undefined;
 }
+export const PLAN_APPROVE_PERMISSION_MODES_AFTER = ["default", "acceptEdits"];
+export function isPlanApprovePermissionModeAfter(raw) {
+    return PLAN_APPROVE_PERMISSION_MODES_AFTER.includes(raw);
+}
+export function storedBodyPermissionMode(body) {
+    return effectivePermissionMode(body, parseTaskSettings(body.settings).settings);
+}
 export function effectiveThinking(reasoningEffort, ultracode) {
     const explicit = isThinkingLevel(reasoningEffort) ? reasoningEffort : undefined;
     if (!ultracode)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.85.0",
+  "version": "7.86.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",