@sema-agent/server 7.85.0 → 7.87.0

package/dist/http/routes/approvals-assistant.js

@@ -6,10 +6,11 @@ import { APPROVAL_GATE_KINDS } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
-import { MAX_APPROVAL_REASON_CHARS } from "../../approval-hmac.js";
+import { MAX_APPROVAL_REASON_CHARS, projectQuestionAnswer, questionAnswerFromProjection } from "../../approval-hmac.js";
+import { PLAN_APPROVE_PERMISSION_MODES_AFTER, isPlanApprovePermissionModeAfter, storedBodyPermissionMode } from "../../task-settings.js";
 import { MAX_APPROVAL_NONCE_CHARS } from "../../plugins/approval-nonce-store.js";
 import { redactedPreview, redactSecrets } from "../../trace/redact.js";
-import { redactRiskDescriptor } from "../../observability/run-terminal-log.js";
+import { redactRiskDescriptor } from "../../observability/run-terminal.js";
 import { fleetRunLabels } from "../../fleet/fleet-bus.js";
 import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
@@ -22,6 +23,8 @@ import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-ke
 const DECIDE_BODY_DECLARED_KEYS = [
     "answer", "boundCallId", "boundInputHash", "checkpointToken", "decision", "reason", "remember", "updatedInput",
 ];
+const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
+const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "remember", "updatedInput"];
 const ACCEPTED_DECIDE_BODY = new Set(DECIDE_BODY_DECLARED_KEYS);
 const UNSUPPORTED_DECIDE_BODY = new Set(["editedPlan", "sessionId", "taskId"]);
 export function decideBodyKeyIssue(raw) {
@@ -46,16 +49,76 @@ export function decideBodyKeyIssue(raw) {
         unsupportedKeys: buckets.unsupported.slice(0, MAX_KEY_ECHO),
     };
 }
+const PLAN_REVIEW_BODY_DECLARED_KEYS = [
+    "boundCallId", "decision", "editedPlan", "permissionModeAfter", "reason",
+];
+const PLAN_REVIEW_PROOF_COVERED_KEYS = ["boundCallId", "decision", "editedPlan", "permissionModeAfter", "reason"];
+const PLAN_REVIEW_NOT_IN_PROOF_KEYS = [];
+const PROOF_SLOT_OF = {
+    answer: "answer",
+    boundCallId: "boundCallId",
+    boundInputHash: "boundInputHash",
+    decision: "decision",
+    editedPlan: "boundInputHash",
+    permissionModeAfter: "permissionModeAfter",
+    reason: "reason",
+};
+function buildApprovalEnvelope(sessionId, covered, reading) {
+    const envelope = { sessionId, decision: reading.decision };
+    for (const key of covered)
+        Object.assign(envelope, { [PROOF_SLOT_OF[key]]: reading[key] });
+    return envelope;
+}
+const ACCEPTED_PLAN_REVIEW_BODY = new Set(PLAN_REVIEW_BODY_DECLARED_KEYS);
+const UNSUPPORTED_PLAN_REVIEW_BODY = new Set([
+    "answer", "boundInputHash", "checkpointToken", "permissionMode", "remember", "sessionId", "taskId", "updatedInput",
+]);
+export function planReviewBodyKeyIssue(raw) {
+    if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const buckets = { unknown: [], unsupported: [] };
+    scanKeyClosure(raw, "", ACCEPTED_PLAN_REVIEW_BODY, UNSUPPORTED_PLAN_REVIEW_BODY, buckets);
+    if (buckets.unknown.length === 0 && buckets.unsupported.length === 0)
+        return null;
+    buckets.unknown.sort();
+    buckets.unsupported.sort();
+    const parts = [
+        ...(buckets.unknown.length > 0 ? [keyClosureClause(buckets.unknown, "unknown (not a plan-review-request key — check the spelling)")] : []),
+        ...(buckets.unsupported.length > 0 ? [keyClosureClause(buckets.unsupported, "unsupported (a sibling approval door's field, a submit-body key, or a path parameter — never read from this body)")] : []),
+    ];
+    return {
+        message: `body: unrecognized top-level key(s) — refused rather than dropped, because a dropped key reads as "in effect" to the caller ` +
+            `(a misspelled \`permissionModeAfter\` silently leaves this task read-only after you approved its plan). ` +
+            `${parts.join("; ")}. ` +
+            `Accepted: ${[...ACCEPTED_PLAN_REVIEW_BODY].sort().join(",")}`,
+        unknownKeys: buckets.unknown.slice(0, MAX_KEY_ECHO),
+        unsupportedKeys: buckets.unsupported.slice(0, MAX_KEY_ECHO),
+    };
+}
 export function decisionReasonOf(body) {
     return typeof body.reason === "string" && body.reason !== "" ? body.reason : undefined;
 }
-export function isQuestionAnswer(v) {
+const QUESTION_ANSWER_TOP_KEYS = ["answers"];
+const QUESTION_ANSWER_ITEM_KEYS = ["header", "selected", "note"];
+const ACCEPTED_QUESTION_ANSWER_TOP = new Set(QUESTION_ANSWER_TOP_KEYS);
+const ACCEPTED_QUESTION_ANSWER_ITEM = new Set(QUESTION_ANSWER_ITEM_KEYS);
+const NO_TOLERATED_KEYS = new Set();
+export function checkQuestionAnswer(v) {
     if (!v || typeof v !== "object" || Array.isArray(v))
-        return false;
+        return { ok: false, kind: "shape" };
     const a = v.answers;
     if (!Array.isArray(a) || a.length === 0)
-        return false;
-    return a.every((it) => {
+        return { ok: false, kind: "shape" };
+    const buckets = { unknown: [], unsupported: [] };
+    scanKeyClosure(v, "answer.", ACCEPTED_QUESTION_ANSWER_TOP, NO_TOLERATED_KEYS, buckets);
+    a.forEach((it, i) => {
+        if (!it || typeof it !== "object" || Array.isArray(it))
+            return;
+        scanKeyClosure(it, `answer.answers[${i}].`, ACCEPTED_QUESTION_ANSWER_ITEM, NO_TOLERATED_KEYS, buckets);
+    });
+    if (buckets.unknown.length > 0)
+        return { ok: false, kind: "unknown_key", keyPaths: buckets.unknown.sort().slice(0, MAX_KEY_ECHO) };
+    const shapeOk = a.every((it) => {
         if (!it || typeof it !== "object" || Array.isArray(it))
             return false;
         const { header, selected, note } = it;
@@ -65,6 +128,7 @@ export function isQuestionAnswer(v) {
             selected.every((s) => typeof s === "string") &&
             (note === undefined || typeof note === "string"));
     });
+    return shapeOk ? { ok: true, value: v } : { ok: false, kind: "shape" };
 }
 async function decideIdempotentReplay(cs, args) {
     const { sessionId, out, binding, decision, payload, deciderPrincipal, explicitOperator, warn } = args;
@@ -133,7 +197,7 @@ async function decideIdempotentReplay(cs, args) {
 export async function handleApprovalsAssistant(req, res, match, ctx) {
     const { deps } = ctx;
     const { preemptableRuns } = ctx.registry;
-    const { readJson, rateLimited, quotaExceeded } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, safeDecode } = ctx.helpers;
     const { resumeCheckpoint, resumePreempted, resumePlanReview } = ctx.legs;
     {
         const cs = deps.checkpointStore;
@@ -143,7 +207,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const scope = operator
                 ? (new URLSearchParams(match.search).get("owner") ?? undefined)
                 : (principal ?? "__none__");
-            await streamApprovals(req, res, cs, scope, deps.config);
+            await streamApprovals(req, res, cs, deps.toolApproval, scope, deps.config);
             return;
         }
         if (match.decl.id === "approvals-list") {
@@ -164,13 +228,9 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     sendError(res, 501, "capability.store_required", "approval exemptions need a store backend");
                     return;
                 }
-                let exSessionId;
-                let exToolName;
-                try {
-                    exSessionId = decodeURIComponent(match.params.sessionId);
-                    exToolName = match.params.tool !== undefined ? decodeURIComponent(match.params.tool) : undefined;
-                }
-                catch {
+                const exSessionId = safeDecode(match.params.sessionId);
+                const exToolName = match.params.tool !== undefined ? safeDecode(match.params.tool) : undefined;
+                if (exSessionId === null || exToolName === null) {
                     sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
                     return;
                 }
@@ -365,9 +425,16 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "edit" ? "edit" : body?.decision === "reject" ? "reject" : undefined;
             if (!decision) {
-                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'edit' | 'reject', editedPlan?, reason? }");
+                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'edit' | 'reject', editedPlan?, reason?, permissionModeAfter? }");
                 return;
             }
+            {
+                const keyIssue = planReviewBodyKeyIssue(body);
+                if (keyIssue) {
+                    sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
+                    return;
+                }
+            }
             if (decision === "edit" && (typeof body.editedPlan !== "string" || body.editedPlan.length === 0)) {
                 sendError(res, 400, "request.field_conflict", "decision 'edit' requires a non-empty editedPlan (the operator's revised plan)");
                 return;
@@ -380,6 +447,14 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "request.field_conflict", `editedPlan is only valid with decision 'edit' (got '${decision}')`);
                 return;
             }
+            if (body.permissionModeAfter !== undefined && !isPlanApprovePermissionModeAfter(body.permissionModeAfter)) {
+                sendError(res, 400, "request.field_invalid", `permissionModeAfter must be one of ${PLAN_APPROVE_PERMISSION_MODES_AFTER.map((m) => JSON.stringify(m)).join(" | ")} when present (the permission mode this task continues in once the plan is approved; absent = "default", which keeps asking before each write)`);
+                return;
+            }
+            if (decision !== "approve" && body.permissionModeAfter !== undefined) {
+                sendError(res, 400, "request.field_conflict", `permissionModeAfter is only valid with decision 'approve' (got '${decision}')`);
+                return;
+            }
             if (body.reason !== undefined && typeof body.reason !== "string") {
                 sendError(res, 400, "request.field_invalid", "reason must be a string");
                 return;
@@ -423,7 +498,13 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
                 const storeNowMs = await store.nowMs();
                 const hdr = (n) => { const h = req.headers[n]; return Array.isArray(h) ? h[0] : h; };
-                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, { sessionId: run.sessionId, boundCallId: planNonce ?? null, boundInputHash: decision === "edit" ? editedPlanBinding(body.editedPlan) : null, decision, reason: typeof body.reason === "string" ? body.reason : null }, deps.config, { actionBinding: false, nowSec: Math.floor(storeNowMs / 1000) });
+                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, buildApprovalEnvelope(run.sessionId, PLAN_REVIEW_PROOF_COVERED_KEYS, {
+                    boundCallId: planNonce ?? null,
+                    decision,
+                    editedPlan: decision === "edit" ? editedPlanBinding(body.editedPlan) : null,
+                    permissionModeAfter: isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined,
+                    reason: typeof body.reason === "string" ? body.reason : null,
+                }), deps.config, { actionBinding: false, nowSec: Math.floor(storeNowMs / 1000) });
                 if (!proof.ok) {
                     sendError(res, proof.status, proof.errorCode, proof.error);
                     return;
@@ -438,6 +519,13 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
+            if (body.permissionModeAfter !== undefined) {
+                const storedCtx = await deps.checkpointStore?.getCtx(run.sessionId).catch(() => null);
+                if (storedCtx?.body !== undefined && storedBodyPermissionMode(storedCtx.body) !== "plan") {
+                    sendError(res, 400, "request.field_conflict", "permissionModeAfter does not apply to this task: it was not submitted with permissionMode \"plan\", so approving the plan lifts no read-only restriction");
+                    return;
+                }
+            }
             if (singleUse !== undefined) {
                 const { proof: onceOnly, store } = singleUse;
                 const fresh = await store.consume(run.sessionId, onceOnly.nonce, onceOnly.acceptedBeforeMs);
@@ -450,18 +538,15 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
             }
-            const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, { taskId, principalPresent: principal !== undefined }, true, { principal: deciderPrincipal, explicitOperator });
+            const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, { taskId, principalPresent: principal !== undefined }, true, { principal: deciderPrincipal, explicitOperator }, isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined);
             sendResumeOutcome(res, out, deps.logger);
             return;
         }
         if (match.decl.id === "approval-decide") {
             if (rateLimited(req, res) || quotaExceeded(req, res))
                 return;
-            let sessionId;
-            try {
-                sessionId = decodeURIComponent(match.params.sessionId);
-            }
-            catch {
+            const sessionId = safeDecode(match.params.sessionId);
+            if (sessionId === null) {
                 sendError(res, 400, "request.path_malformed", "malformed approval id (invalid percent-encoding)");
                 return;
             }
@@ -511,12 +596,19 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 remember = true;
             }
             let answer;
+            let answerProjection;
             if (body.answer !== undefined) {
-                if (!isQuestionAnswer(body.answer)) {
-                    sendError(res, 400, "request.body_shape", "malformed answer — expected { answers: [{ header, selected: string[], note? }] }");
+                const checked = checkQuestionAnswer(body.answer);
+                if (!checked.ok) {
+                    if (checked.kind === "shape") {
+                        sendError(res, 400, "request.body_shape", "malformed answer — expected { answers: [{ header, selected: string[], note? }] }");
+                        return;
+                    }
+                    sendError(res, 400, "request.field_invalid", `answer: unrecognized key(s) — refused rather than dropped, because a dropped key reads as "in effect" to the caller (a misspelled selected key silently drops part of the operator's answer). ${keyClosureClause([...checked.keyPaths], "unknown (not a question-answer key — check the spelling)")}. Accepted: answers, answers[].header, answers[].selected, answers[].note`, { unknownKeys: [...checked.keyPaths] });
                     return;
                 }
-                answer = body.answer;
+                answerProjection = projectQuestionAnswer(checked.value);
+                answer = questionAnswerFromProjection(answerProjection);
             }
             for (const f of ["checkpointToken", "boundCallId", "boundInputHash"]) {
                 if (body[f] !== undefined && typeof body[f] !== "string") {
@@ -528,6 +620,10 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "updated_input_not_in_proof", "updatedInput is not supported on a direct-door worker (not covered by the decision proof)");
                 return;
             }
+            if (deps.config.directDoorActive && body.checkpointToken !== undefined) {
+                sendError(res, 400, "checkpoint_token_not_in_proof", "checkpointToken is not supported on a direct-door worker (not covered by the decision proof); bind the decision with boundCallId and boundInputHash instead");
+                return;
+            }
             const binding = {
                 checkpointToken: body.checkpointToken,
                 boundCallId: body.boundCallId,
@@ -540,7 +636,13 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     const h = req.headers[n];
                     return Array.isArray(h) ? h[0] : h;
                 };
-                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, { sessionId, boundCallId: binding.boundCallId, boundInputHash: binding.boundInputHash, decision, reason: typeof body.reason === "string" ? body.reason : null }, deps.config);
+                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, buildApprovalEnvelope(sessionId, DECIDE_PROOF_COVERED_KEYS, {
+                    answer: answerProjection,
+                    boundCallId: binding.boundCallId,
+                    boundInputHash: binding.boundInputHash,
+                    decision,
+                    reason: typeof body.reason === "string" ? body.reason : null,
+                }), deps.config);
                 if (!proof.ok) {
                     sendError(res, proof.status, proof.errorCode, proof.error);
                     return;
@@ -619,7 +721,24 @@ function projectPendingForWire(row, governance) {
     const governanceForced = governanceOriginOf({ riskDescriptor: row.riskDescriptor ?? undefined }, governance);
     return governanceForced ? { ...redacted, governanceForced } : redacted;
 }
-export async function streamApprovals(req, res, cs, scope, governance, pollMs = APPROVALS_STREAM_POLL_MS) {
+function createSseDeltaLane(res, spec) {
+    let prev = new Map();
+    return {
+        tick(rows) {
+            const cur = new Map(rows.map((r) => [spec.keyOf(r), { row: r, bytes: spec.bytesOf(r) }]));
+            for (const [k, v] of cur) {
+                if (prev.get(k)?.bytes !== v.bytes)
+                    res.write(`event: ${spec.upsertEvent}\ndata: ${JSON.stringify(spec.upsertData(v.row, Date.now()))}\n\n`);
+            }
+            for (const [k, v] of prev) {
+                if (!cur.has(k))
+                    res.write(`event: ${spec.exitEvent}\ndata: ${JSON.stringify(spec.exitData(v.row, Date.now()))}\n\n`);
+            }
+            prev = cur;
+        },
+    };
+}
+export async function streamApprovals(req, res, cs, live, scope, governance, pollMs = APPROVALS_STREAM_POLL_MS) {
     const keyOf = (p) => JSON.stringify([p.sessionId, p.toolCallId ?? null]);
     sseHeaders(res);
     res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, mode: "approvals-delta", pollMs: APPROVALS_STREAM_POLL_MS })}\n\n`);
@@ -627,13 +746,29 @@ export async function streamApprovals(req, res, cs, scope, governance, pollMs =
     bindSseLifecycle(req, res, () => { closed = true; });
     const start = Date.now();
     let lastBeat = Date.now();
-    let prev = new Map();
-    let prevFrames = new Map();
+    const durableLane = createSseDeltaLane(res, {
+        upsertEvent: "pending",
+        exitEvent: "resolved",
+        keyOf,
+        bytesOf: (p) => JSON.stringify({ type: "pending", ...p }),
+        upsertData: (p, nowMs) => ({ type: "pending", ...p, serverNowMs: nowMs }),
+        exitData: (p, nowMs) => ({ type: "resolved", sessionId: p.sessionId, toolCallId: p.toolCallId, serverNowMs: nowMs }),
+    });
+    const liveLane = createSseDeltaLane(res, {
+        upsertEvent: "live_pending",
+        exitEvent: "live_resolved",
+        keyOf: (r) => r.approvalId,
+        bytesOf: (r) => JSON.stringify({ type: "live_pending", ...r }),
+        upsertData: (r, nowMs) => ({ type: "live_pending", ...r, serverNowMs: nowMs }),
+        exitData: (r, nowMs) => ({ type: "live_resolved", approvalId: r.approvalId, serverNowMs: nowMs }),
+    });
     let first = true;
     while (!closed) {
         let pending;
+        let livePending;
         try {
             pending = (await cs.listPending(scope)).map((r) => projectPendingForWire(r, governance));
+            livePending = live ? live.listLivePending(scope) : [];
         }
         catch {
             if (!res.writableEnded)
@@ -641,25 +776,12 @@ export async function streamApprovals(req, res, cs, scope, governance, pollMs =
             await sleep(pollMs);
             continue;
         }
-        const cur = new Map(pending.map((p) => [keyOf(p), p]));
-        const curFrames = new Map([...cur].map(([k, p]) => [k, JSON.stringify({ type: "pending", ...p })]));
-        const pendingFrame = (k) => JSON.stringify({ type: "pending", ...cur.get(k), serverNowMs: Date.now() });
+        durableLane.tick(pending);
+        liveLane.tick(livePending);
         if (first) {
-            for (const k of curFrames.keys())
-                res.write(`event: pending\ndata: ${pendingFrame(k)}\n\n`);
             res.write(`event: synced\ndata: ${JSON.stringify({ type: "synced", count: pending.length })}\n\n`);
             first = false;
         }
-        else {
-            for (const [k, frame] of curFrames)
-                if (prevFrames.get(k) !== frame)
-                    res.write(`event: pending\ndata: ${pendingFrame(k)}\n\n`);
-            for (const [k, p] of prev)
-                if (!cur.has(k))
-                    res.write(`event: resolved\ndata: ${JSON.stringify({ type: "resolved", sessionId: p.sessionId, toolCallId: p.toolCallId, serverNowMs: Date.now() })}\n\n`);
-        }
-        prev = cur;
-        prevFrames = curFrames;
         if (Date.now() - start > SSE_MAX_STREAM_MS) {
             res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "approvals stream reached its 15-minute cap — reconnect to continue" })}\n\n`);
             break;

package/dist/http/routes/capabilities.js

@@ -13,6 +13,7 @@ import { projectMemoryEngineCapability } from "../../memory-posture.js";
 import { projectWriteProtectionCapability } from "../../write-protection.js";
 import { projectSqlEngineCapability } from "../../sql-engine-posture.js";
 import { projectWebSearchCapability } from "../../plugins/web-search.js";
+import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
 import { workflowModelAllowlistFor, selfOrchestrationDenial } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
@@ -126,6 +127,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 interactiveTools: true,
                 projectContext: cwdHonored(deps.config),
                 callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
+                executionLane: projectExecutionLaneCapability(deps.config),
                 mcpInjection: mcpInjectionHonored(deps.config),
                 a2a: true,
                 a2aInjection: a2aInjectionHonored(deps.config),

package/dist/http/routes/images.js

@@ -41,7 +41,7 @@ const RUNNER_ERROR_CODES = new Set(["band-conflict", "duplicate", "disk", "timeo
 const SANDBOX_BASE_PROFILE = "sandbox-base";
 export async function handleImages(req, res, match, ctx) {
     const { deps } = ctx;
-    const { readJson } = ctx.helpers;
+    const { readJson, safeDecode } = ctx.helpers;
     const { source } = ctx.req;
     const { bakeSubmitLimiter } = ctx.local.images;
     if (deps.imageBakes && isBakeRouteId(match.decl.id)) {
@@ -128,7 +128,11 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
             }
-            const bakeId = decodeURIComponent(match.params.bakeId);
+            const bakeId = safeDecode(match.params.bakeId);
+            if (bakeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const bake = await bakes.getBake(bakeId);
             if (!bake) {
                 sendError(res, 404, "not_found.bake", "bake not found");
@@ -142,7 +146,11 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
             }
-            const bakeId = decodeURIComponent(match.params.bakeId);
+            const bakeId = safeDecode(match.params.bakeId);
+            if (bakeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const bake = await bakes.getBake(bakeId);
             if (!bake) {
                 sendError(res, 404, "not_found.bake", "bake not found");
@@ -178,7 +186,11 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 403, "auth.bake_runner_only", "bake-runner only");
                 return;
             }
-            const bakeId = decodeURIComponent(match.params.bakeId);
+            const bakeId = safeDecode(match.params.bakeId);
+            if (bakeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const body = (await readJson(req));
             const runnerId = typeof body.runnerId === "string" && body.runnerId.length > 0 ? body.runnerId : (principal ?? source ?? cfg.runnerPrincipal);
             const claimed = await bakes.claimBake(bakeId, runnerId, cfg.leaseMs);
@@ -194,7 +206,11 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 403, "auth.bake_runner_only", "bake-runner only");
                 return;
             }
-            const bakeId = decodeURIComponent(match.params.bakeId);
+            const bakeId = safeDecode(match.params.bakeId);
+            if (bakeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const bake = await bakes.getBake(bakeId);
             if (!bake) {
                 sendError(res, 404, "not_found.bake", "bake not found");
@@ -238,7 +254,11 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
             }
-            const bakeId = decodeURIComponent(match.params.bakeId);
+            const bakeId = safeDecode(match.params.bakeId);
+            if (bakeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const bake = await bakes.getBake(bakeId);
             if (!bake) {
                 sendError(res, 404, "not_found.bake", "bake not found");
@@ -335,7 +355,12 @@ export async function handleImages(req, res, match, ctx) {
             return;
         }
         if (match.decl.id === "image-by-digest") {
-            const entry = await idx.getByDigest(decodeURIComponent(match.params.digest));
+            const digest = safeDecode(match.params.digest);
+            if (digest === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
+            const entry = await idx.getByDigest(digest);
             if (!entry || (!viewer.operator && entry.visibility === "tenant" && entry.tenantId !== viewer.tenantId)) {
                 sendError(res, 404, "not_found.image", "not found");
                 return;
@@ -344,7 +369,12 @@ export async function handleImages(req, res, match, ctx) {
             return;
         }
         if (match.decl.id === "image-by-profile") {
-            const entry = await idx.latestPublished(decodeURIComponent(match.params.profile), viewer);
+            const profile = safeDecode(match.params.profile);
+            if (profile === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
+            const entry = await idx.latestPublished(profile, viewer);
             if (!entry) {
                 sendError(res, 404, "not_found.image", "not found");
                 return;

package/dist/http/routes/mcp-reconnect.d.ts

@@ -33,7 +33,7 @@
  * 路径是 session,动词挂在 **run 句柄**上 ⇒ 会话属主门(`sessionStorage.ownerOf`,未知与他人**同码同串**
  * 404 无 oracle,与 `POST /v1/sessions/:id/notify` 逐字同形)→ `getActiveTaskId` 取本会话的活 run →
  * `steerableRuns` 取本副本活流。非 live 的四臂一码 409 `steering.not_running`,判据取词表属主
- * (`isParkedRunStatus` / `isTerminalRunStatus`)与 `runProvenElsewhere`(四处手抄已收编成一只谓词)。
+ * (`isParkedRunStatus` / `isTerminalRunStatus`)与 `runProvenElsewhere`(手抄已收编成一只谓词,S-430 起同住 `plugins/store-contracts.ts`)。
  * 显式 operator 可重拨任何租户的会话(监督动作,与 notify / steer 同臂;**不是** bare `isOperator`)。
  *
  * ── 计费/门 ─────────────────────────────────────────────────────────────────────────────────────

package/dist/http/routes/mcp-reconnect.js

@@ -1,9 +1,9 @@
 import { z } from "zod";
-import { isParkedRunStatus, isTerminalRunStatus } from "../../plugins/store-contracts.js";
+import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
-import { runProvenElsewhere } from "../route-ctx.js";
+import {} from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 const BodySchema = z.object({ server: z.string().min(1).max(190) }).strict();
 const NEUTRALIZED_TEXT_MAX = 200;

package/dist/http/routes/memory-policy.js

@@ -63,7 +63,7 @@ function sendScopeGateRefusal(res, gate) {
 }
 export async function handleMemoryPolicy(req, res, match, ctx) {
     const { deps } = ctx;
-    const { readJson } = ctx.helpers;
+    const { readJson, safeDecode } = ctx.helpers;
     switch (match.decl.id) {
         case "memory-export": {
             const principal = gatedPrincipal(req, deps.config);
@@ -135,11 +135,8 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
                 sendError(res, 501, "capability.memory_store_required", "memory sync requires a DB memory backend (MEMORY_ENGINE_BACKEND=pg|tidb)");
                 return;
             }
-            let scope;
-            try {
-                scope = decodeURIComponent(match.params.scope);
-            }
-            catch {
+            const scope = safeDecode(match.params.scope);
+            if (scope === null) {
                 sendError(res, 400, "memory_sync_invalid_scope", "malformed percent-encoding in :scope");
                 return;
             }

package/dist/http/routes/notify-wake.js

@@ -6,7 +6,7 @@ import { assertNever } from "../route-ctx.js";
 export async function handleNotifyWake(req, res, match, ctx) {
     const { deps } = ctx;
     const { steerableRuns } = ctx.registry;
-    const { readJson, rateLimited, quotaExceeded, leaseDenied } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, leaseDenied, safeDecode } = ctx.helpers;
     const { resumeWake } = ctx.legs;
     switch (match.decl.id) {
         case "session-notify": {
@@ -17,7 +17,11 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            const notifySession = decodeURIComponent(match.params.sessionId);
+            const notifySession = safeDecode(match.params.sessionId);
+            if (notifySession === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
             let nb;
             try {
                 nb = (await readJson(req));
@@ -111,7 +115,11 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            const wakeSession = decodeURIComponent(match.params.sessionId);
+            const wakeSession = safeDecode(match.params.sessionId);
+            if (wakeSession === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
             let wakeBody;
             try {
                 wakeBody = (await readJson(req));

package/dist/http/routes/run-memory-capture.js

@@ -1,8 +1,8 @@
 import { z } from "zod";
-import { isParkedRunStatus, isTerminalRunStatus } from "../../plugins/store-contracts.js";
+import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
-import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage, runProvenElsewhere } from "../route-ctx.js";
+import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 const BodySchema = z.object({ reason: z.string().min(1).max(500).optional() }).strict();
 export async function handleRunMemoryCapture(req, res, match, ctx) {
@@ -31,10 +31,8 @@ export async function handleRunMemoryCapture(req, res, match, ctx) {
                 sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
                 return;
             }
-            if (run.owner !== null && run.owner !== principal) {
-                sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+            if (!ctx.helpers.runOwnerOk(req, res, run.owner))
                 return;
-            }
             const live = ctx.registry.steerableRuns.get(taskId);
             if (live) {
                 try {