@sema-agent/server 7.85.0 → 7.87.0

package/dist/observability/{run-terminal-log.js → run-terminal.js}

@@ -10,20 +10,38 @@ export function runTerminalLogLevel(status, errorCode) {
         return undefined;
     return errorCode === "cancelled" ? "info" : "error";
 }
-let observer;
-export function setRunTerminalObserver(fn) {
-    observer = fn;
+let logObserver;
+const subscribers = new Set();
+export function setRunTerminalLogObserver(fn) {
+    logObserver = fn;
+}
+export function subscribeRunTerminal(fn) {
+    subscribers.add(fn);
+    return () => {
+        subscribers.delete(fn);
+    };
+}
+export function resetRunTerminalSubscribersForTest() {
+    subscribers.clear();
 }
 export function notifyRunTerminal(rec) {
+    for (const fn of [...subscribers]) {
+        try {
+            fn(rec);
+        }
+        catch (err) {
+            recordFailOpen("server.fleet.terminal-notify", `runId=${rec.runId} err=${errorText(err)}`);
+        }
+    }
     const level = runTerminalLogLevel(rec.status, rec.errorCode);
-    if (level === undefined || !observer)
+    if (level === undefined || !logObserver)
         return;
     const raw = rec.errorMessage;
     const message = raw === undefined ? undefined : (redactErrorMessage(raw) ?? "").slice(0, MESSAGE_CAP);
-    observer(level, {
+    logObserver(level, {
         runId: rec.runId,
-        sessionId: rec.sessionId,
-        ...(rec.owner !== null ? { owner: rec.owner } : {}),
+        sessionId: rec.sessionId ?? "",
+        ...(rec.owner !== undefined && rec.owner !== null ? { owner: rec.owner } : {}),
         status: rec.status,
         ...(rec.resultTaskId !== undefined && rec.resultTaskId !== rec.runId ? { taskId: rec.resultTaskId } : {}),
         ...(rec.model !== undefined ? { model: rec.model } : {}),
@@ -365,6 +383,7 @@ const STATS_GATE_ROW_TREATMENT = {
     decision: "verbatim",
     toolName: "verbatim",
     toolArg: "model-text",
+    toolCallId: "verbatim",
 };
 const STATS_REPETITION_EVENT_TREATMENT = {
     turn: "verbatim",
@@ -667,4 +686,4 @@ export function resetReadRedactionMemoForTest() {
     readMemoDirty.clear();
     readMemoDirtyBytes = 0;
 }
-//# sourceMappingURL=run-terminal-log.js.map
+//# sourceMappingURL=run-terminal.js.map

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -754,7 +754,9 @@ export declare class SqlCheckpointStore implements CheckpointStore {
      */
     peekScopeByToken(token: CheckpointToken): Promise<string | null | undefined>;
     peekPendingScope(sessionId: string, binding?: PendingRowBinding): Promise<string | null | undefined>;
-    /** Upsert the resume rebuild inputs for a session (written at SUBMIT when durable mode is on). */
+    /** Upsert the resume rebuild inputs for a session — written at SUBMIT (durable mode on) and, since S-433 F2,
+     *  once per resume leg at its CAS win point (`DriveResumeArgs.resumeCtx`). Unconditional per `session_id`:
+     *  the ordering fence lives at the CALLER's CAS win, not in a version column here. */
     putCtx(sessionId: string, ctx: unknown): Promise<void>;
     getCtx<T = unknown>(sessionId: string): Promise<T | null>;
     /**
@@ -763,7 +765,11 @@ export declare class SqlCheckpointStore implements CheckpointStore {
      *
      * The extra `task_active` guard closes a multi-gate window: between a resume's CAS (pending→resolved) and
      * the task hitting its NEXT gate (writing a new pending checkpoint), the session has no pending checkpoint —
-     * yet `putCtx` only stamps `updated_at_ms` at submit, so the ctx could be older than `cutoff` and was being
+     * yet `putCtx` stamps `updated_at_ms` at submit and — since S-433 F2 (server 7.86.0) — once more on EVERY
+     * resume leg, at the moment that leg wins the resume CAS (`DriveResumeArgs.resumeCtx`; before that fix only
+     * the plan approval's mode write-back re-stamped it, and it did so AFTER acceptance). Both extra writes only
+     * ever REFRESH the stamp, so they lengthen a ctx's life and touch none of the three guards — the direction is
+     * "keep it longer", never "reap it sooner". So the ctx could be older than `cutoff` and was being
      * reaped, making the next resume 409 ("resume context missing"). `task_active` holds the session lock for
      * the WHOLE submit→last-resume-complete span (running OR suspended), so excluding sessions with an active
      * claim keeps the ctx exactly as long as a run still needs it, while still GC'ing it once the run is terminal.

package/dist/plugins/file-run-store.js

@@ -1,4 +1,4 @@
-import { redactErrorMessage, redactLedgerEventData, redactTerminalResult } from "../observability/run-terminal-log.js";
+import { redactErrorMessage, redactLedgerEventData, redactTerminalResult } from "../observability/run-terminal.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
@@ -7,7 +7,7 @@ import { terminalProjection } from "@sema-agent/core";
 import { AppendLog, atomicWriteFile, ensureDir, isProcessLive, processFingerprint, readJsonlRecords, sanitizePathComponent, writeThenLink } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
-import { notifyRunTerminal } from "../observability/run-terminal-log.js";
+import { notifyRunTerminal } from "../observability/run-terminal.js";
 import { migrateRetiredAskOrigin } from "./one-time-migrations.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 const CLAIM_TAKEOVER_ATTEMPTS = 3;

package/dist/plugins/memory-run-store.js

@@ -1,7 +1,7 @@
-import { redactErrorMessage, redactLedgerEventData, redactTerminalResult } from "../observability/run-terminal-log.js";
+import { redactErrorMessage, redactLedgerEventData, redactTerminalResult } from "../observability/run-terminal.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
 import { terminalProjection } from "@sema-agent/core";
-import { notifyRunTerminal } from "../observability/run-terminal-log.js";
+import { notifyRunTerminal } from "../observability/run-terminal.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 export class MemoryRunStore {
     runs = new Map();

package/dist/plugins/remote-scratchpad.js

@@ -1,4 +1,4 @@
-import { redactHead } from "../observability/run-terminal-log.js";
+import { redactHead } from "../observability/run-terminal.js";
 const REMOTE_SCRATCHPAD_LANES = new Set(["e2b", "k8s", "local-docker", "ssh", "device"]);
 export function isRemoteScratchpadLane(provider) {
     return provider !== undefined && REMOTE_SCRATCHPAD_LANES.has(provider);

package/dist/plugins/run-store-sql.js

@@ -1,10 +1,10 @@
-import { redactErrorMessage, redactLedgerEventData, redactTerminalResult } from "../observability/run-terminal-log.js";
+import { redactErrorMessage, redactLedgerEventData, redactTerminalResult } from "../observability/run-terminal.js";
 import { terminalProjection } from "@sema-agent/core";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
 import { escapeLike } from "./sql-escape.js";
 import { pgSanitizeText } from "./pg-safe-json.js";
 import { parseJsonLenient as parseJson, toIso as iso } from "./sql-row-helpers.js";
-import { notifyRunTerminal, runTerminalLogLevel } from "../observability/run-terminal-log.js";
+import { notifyRunTerminal, runTerminalLogLevel } from "../observability/run-terminal.js";
 import { mysqlDriver, pgDriver, dialectJsonEncoder } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
 const RUN_ROW_COLS = "task_id, session_id, owner, status, result, error, error_code, job_id, source, instance_id, cancel_requested, objective_preview, created_at, updated_at";
@@ -121,6 +121,7 @@ export class SqlRunStore {
         result = redactTerminalResult(result);
         error = error === null ? null : (redactErrorMessage(error) ?? null);
         const errorCode = result === null ? null : (terminalProjection(result.terminal).errorCode ?? null);
+        let won = false;
         let observed;
         await this.tx(async (conn) => {
             const w = await conn.query(this.q("UPDATE task_run SET status = ?, result = ?, error = ?, error_code = ?, updated_at = ? WHERE task_id = ? AND status IN ('running','suspended','needs_review')", "UPDATE task_run SET status = $1, result = $2::jsonb, error = $3, error_code = $4, updated_at = $5 WHERE task_id = $6 AND status IN ('running','suspended','needs_review')"), [
@@ -131,7 +132,8 @@ export class SqlRunStore {
                 new Date(),
                 taskId,
             ]);
-            if (w.affected > 0 && runTerminalLogLevel(status, errorCode ?? undefined) !== undefined) {
+            won = w.affected > 0;
+            if (won && runTerminalLogLevel(status, errorCode ?? undefined) !== undefined) {
                 const { rows } = await conn.query(this.q("SELECT owner, session_id, created_at FROM task_run WHERE task_id = ?", "SELECT owner, session_id, created_at FROM task_run WHERE task_id = $1"), [taskId]);
                 const row = rows[0];
                 const createdAt = row ? Date.parse(iso(row.created_at)) : NaN;
@@ -143,17 +145,16 @@ export class SqlRunStore {
             }
             await conn.query(this.q("DELETE FROM task_active WHERE task_id = ?", "DELETE FROM task_active WHERE task_id = $1"), [taskId]);
         });
-        if (observed) {
+        if (won) {
             notifyRunTerminal({
                 runId: taskId,
-                sessionId: observed.sessionId,
-                owner: observed.owner,
+                ...(observed ? { sessionId: observed.sessionId, owner: observed.owner } : {}),
                 status,
                 resultTaskId: result?.taskId,
                 model: result?.model,
                 errorCode: errorCode ?? undefined,
                 errorMessage: (result === null ? undefined : terminalProjection(result.terminal).errorMessage) ?? error ?? undefined,
-                elapsedMs: observed.createdAt === undefined ? undefined : Math.max(0, Date.now() - observed.createdAt),
+                elapsedMs: observed?.createdAt === undefined ? undefined : Math.max(0, Date.now() - observed.createdAt),
             });
         }
     }

package/dist/plugins/store-contracts.d.ts

@@ -153,7 +153,7 @@ export interface RunRecord {
  *  · `parked` —— 停在门上还能再动(`suspended` 审批/资源门、`needs_review` 评审门)。
  *
  * 🔴 为什么是**一张表**而不是三张 switch(S-213③,2026-09-11):`blocked` 这个词此前在本仓有**两个
- * 独立写者**且答案互斥 —— `observability/run-terminal-log.ts` 判它是「治理判决,不是失败 ⇒ 不打行」,
+ * 独立写者**且答案互斥 —— `observability/run-terminal.ts` 判它是「治理判决,不是失败 ⇒ 不打行」,
  * `fleet/fleet-bus.ts` 判它是「非成功终局(agent 放弃)⇒ failed 桶、行离场」。两处各自穷举、各自正确
  * 地编译,而一条 `report_blocked` 的 run 在面板上离场、在引擎日志里一个字都没有。三张手抄的 switch
  * 就是三个写者;收成一张表之后,词的语义只有这一处能改。
@@ -165,7 +165,7 @@ export interface RunRecord {
  * core 已经没有的词同样红(超出键)。终局词表真变过(core 5.8.0 把 `"timeout"` 从 `TaskStatus` 删了)。
  *
  * 判据不许再被手抄成第二份:消费点(`approval-reconciler.ts` 判据 2、`http/routes/runs.ts` 的取消后
- * 复读、`observability/run-terminal-log.ts` 的级别判、`fleet/fleet-bus.ts` 的 failed 桶编译钉)都从这里取。
+ * 复读、`observability/run-terminal.ts` 的级别判、`fleet/fleet-bus.ts` 的 failed 桶编译钉)都从这里取。
  */
 export type RunStatusClass = "live" | "succeeded" | "unsuccessful" | "parked";
 export declare const RUN_STATUS_CLASS: {
@@ -240,6 +240,29 @@ export declare function isUnsuccessfulRunStatus(status: RunRecord["status"]): bo
  * 动作(cancel 的恢复把手会 CAS-expire 一张 checkpoint);对一个本进程读不懂的状态,少动一次远好过错杀。
  */
 export declare function isParkedRunStatus(status: RunRecord["status"]): boolean;
+/**
+ * 「**证得出**这条 run 活在别的副本上」——「他副本」那一句话的**唯一判据**(S-381 收编;S-430 迁居)。
+ *
+ * 成案:这个合取式此前在四处**逐字手抄**(`http/routes/runs.ts` 的 steer 臂与 interrupt 臂、同文件
+ * `sendHandleMiss`、`http/routes/run-memory-capture.ts`),`POST /v1/sessions/:id/mcp/reconnect` 是第五处、`fleet/fleet-reconciler.ts` 是第六处 ——
+ * 而它的每一个合取项都是一条**被复审逐条挣出来的**纪律,不是随手的判空:
+ *  · {@link RunRecord.instanceId} 缺席(`null` / 建列之前的行 / 替身行的 `undefined`)= **不知道它在哪**,
+ *    不是「在别处」;
+ *  · `thisInstanceId` 缺席 = 本副本连自己是谁都说不上,更不能断言别人;
+ *  · 两者都在场且**不等**才够格说「他副本」(`markResuming` 认领后该列语义 = **当前持有副本**)。
+ * 抄一份 = 多一个写者;收成一只谓词之后,纪律改一次就处处同改。**`status` 不进本谓词**:
+ * `sendHandleMiss` 只对 `running` 行说这句话,而 steer 族在 park/终态两臂之后才走到这里 —— 各调用点
+ * 的前置臂不同族,合进来会让某一处悄悄改判。
+ *
+ * 🔴 **为什么住在这里而不是 `http/route-ctx.ts`**(S-430):`src/fleet/fleet-reconciler.ts` 是第六个手抄点,
+ * 而 `src/fleet/` 今天对 `src/http/` **零依赖**(边向恒是 http → fleet)。把消费方拉去 http 取一只纯谓词
+ * 会凭空造一条反向装载边;而本文件正是 {@link RunRecord} 与它的兄弟谓词({@link isTerminalRunStatus} /
+ * {@link isParkedRunStatus})的所在 —— 「关于 run 行的判词」本来就该在行的属主这里,http 与 fleet 都已经
+ * 依赖它。**无别名、无再导出**:旧拼法删干净,消费方的 tsc 红就是通知。
+ */
+export declare function runProvenElsewhere(run: {
+    instanceId?: string | null;
+}, thisInstanceId: string | undefined): boolean;
 /** One row of the GET /v1/sessions list (CC /resume picker): a DISTINCT session (sessionId) aggregated from its
  *  task_run rows — newest-first by last activity. The preview/status are the LATEST run's ("continue where I left
  *  off"); the counts/timestamps span the whole session. Owner included so a fleet-wide (ops) listing is attributable. */

package/dist/plugins/store-contracts.js

@@ -23,6 +23,9 @@ export function isUnsuccessfulRunStatus(status) {
 export function isParkedRunStatus(status) {
     return runStatusClassOf(status) === "parked";
 }
+export function runProvenElsewhere(run, thisInstanceId) {
+    return typeof run.instanceId === "string" && run.instanceId.length > 0 && thisInstanceId !== undefined && run.instanceId !== thisInstanceId;
+}
 export function mapBakeRow(r) {
     return {
         bakeId: r.bake_id,

package/dist/plugins/workflow-run-store-sql.js

@@ -1,4 +1,4 @@
-import { redactErrorMessage, redactHead } from "../observability/run-terminal-log.js";
+import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { summarizeWorkflowRun, isTerminalWorkflowStatus, WorkflowRunStoreError } from "@sema-agent/core";
 import { foldKeyFamily, MAX_PENDING_PER_SESSION, PURGE_FENCE_MS, SERVED_FENCE_MS, } from "../orchestration/workflow-completion-inbox.js";
 import {} from "../orchestration/workflow-agent-session-index.js";

package/dist/principal-jwt.d.ts

@@ -1,4 +1,5 @@
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
+import { type ApprovalEnvelope } from "./approval-hmac.js";
 /**
  * 验签允许的**时钟不一致容差**(秒)—— 本仓这条轴上的单一来源。
  *
@@ -47,6 +48,14 @@ export declare function verifyPrincipalJwt(token: string, keys: PrincipalJwtKey[
 /** 良构 Unicode(无孤立代理项)。`u` 旗下配对代理项是一个码点、不匹配 `\p{Surrogate}`;只有孤立的才命中。 */
 export declare function isWellFormedUnicode(s: string): boolean;
 export declare function editedPlanBinding(editedPlan: string): string;
+/**
+ * JWT `cnf.bnd` = **「这份身份凭据被签发去决哪一张卡」**(动作身份),故只哈希前三位。
+ *
+ * 🔴 **与 HMAC 信封的分工**(S-433 F1 立此,属主注在 `approval-hmac.ts` 顶):HMAC 绑的是**「决了什么」**
+ * —— `decision` / `reason` / `permissionModeAfter` 这些**会改变后果**的字段全在那一把里。所以「同一张卡上
+ * 把 approve 的档偷偷调宽」只由 HMAC 拦;本函数**刻意不跟着加位**:决定内容改了 `cnf.bnd` 不该变(否则
+ * 一份合法 JWT 会被绑死在一个它签发时还不知道的值上,而 `permissionModeAfter` 恰恰是决裁那一刻才定的)。
+ */
 export declare function approvalBnd(env: {
     sessionId: string;
     boundCallId?: string | null;
@@ -109,13 +118,12 @@ export declare function verifyDirectDoorProof(proof: {
     jwt?: string;
     mac?: string;
     kid?: string;
-}, envelope: {
-    sessionId: string;
-    boundCallId?: string | null;
-    boundInputHash?: string | null;
-    decision: string;
-    reason?: string | null;
-}, config: {
+}, 
+/** 🔴 **命名类型,不是结构等价的内联字面**(S-433 F1 [high] 的**根因**,验真后修):本位此前是一份手抄的
+ *  五字段内联形 —— 结构类型让**多带一个字段的调用方**照样编译通过,而下面那次手抄再把它**丢掉**,于是
+ *  `approval-hmac.ts` 上新增的签名位在这条唯一的真实验签链上**静默失效**,tsc 一个字都不响。
+ *  用 {@link ApprovalEnvelope} 之后,信封的形只有**一个**声明点,新增一位自动到达验签器。 */
+envelope: ApprovalEnvelope, config: {
     principalJwtPubkeys: PrincipalJwtKey[];
     principalJwtIss?: string;
     principalJwtAud?: string;

package/dist/principal-jwt.js

@@ -101,7 +101,7 @@ export function verifyDirectDoorProof(proof, envelope, config, opts) {
         return { ok: false, status: 401, errorCode: "principal_unbound", error: "principal token is not bound to this decision (cnf.bnd mismatch)" };
     if (!proof.mac)
         return { ok: false, status: 401, errorCode: "approval_mac_required", error: "direct door requires an approval MAC (X-Approval-Mac)" };
-    const ok = verifyApprovalHmac({ sessionId: envelope.sessionId, boundCallId: envelope.boundCallId ?? null, boundInputHash: envelope.boundInputHash ?? null, decision: envelope.decision, reason: envelope.reason ?? null }, proof.mac, proof.kid, config.approvalHmacKeys);
+    const ok = verifyApprovalHmac(envelope, proof.mac, proof.kid, config.approvalHmacKeys);
     if (!ok)
         return { ok: false, status: 401, errorCode: "approval_mac_invalid", error: "approval envelope MAC invalid" };
     return actionBinding

package/dist/runs.js

@@ -1,7 +1,7 @@
 import { runWithVerification, runCascade, defaultTaskRegistry, terminalProjection, DURABLE_AGENT_HANDLE_RE } from "@sema-agent/core";
 import { failureCodeOf, stripResumeToken } from "./terminal.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
-import { redactErrorMessage } from "./observability/run-terminal-log.js";
+import { redactErrorMessage } from "./observability/run-terminal.js";
 import { withPrincipal } from "./observability/principal-context.js";
 import { redactSecrets } from "./trace/redact.js";
 import { taskNotificationEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "./trace/project.js";

package/dist/session-titler.js

@@ -26,6 +26,10 @@ export function createSessionTitler(deps) {
         deps.logger?.debug?.("session_title_failed", { sessionId, error: error.slice(0, 200) });
         recordFailOpen("server.session-titler.gateway-unreachable", error.slice(0, FAIL_CAUSE_KEY_CHARS));
     };
+    const probeOrContinue = async (sessionId, continueWord) => deps
+        .probeTitle(sessionId)
+        .then((state) => ({ state, unreadable: false }))
+        .catch(() => ({ state: continueWord, unreadable: true }));
     return {
         maybeTitle(sessionId, objective, model) {
             if (!sessionId || !objective.trim())
@@ -39,10 +43,10 @@ export function createSessionTitler(deps) {
             }
             seen.add(sessionId);
             void (async () => {
-                let state = await deps.probeTitle(sessionId).catch(() => "untitled");
+                let state = (await probeOrContinue(sessionId, "untitled")).state;
                 if (state === "none") {
                     await new Promise((r) => setTimeout(r, NO_ROW_RETRY_MS));
-                    state = await deps.probeTitle(sessionId).catch(() => "untitled");
+                    state = (await probeOrContinue(sessionId, "untitled")).state;
                     if (state === "none") {
                         seen.delete(sessionId);
                         deps.metrics?.inc("session_title_total", { outcome: "row_not_yet" });
@@ -66,10 +70,10 @@ export function createSessionTitler(deps) {
                 }
                 const landed = await deps.setTitleIfNull(sessionId, title);
                 if (!landed) {
-                    const after = await deps.probeTitle(sessionId).catch(() => "titled");
-                    if (after === "none")
+                    const after = await probeOrContinue(sessionId, "none");
+                    if (after.state === "none")
                         seen.delete(sessionId);
-                    deps.metrics?.inc("session_title_total", { outcome: after === "none" ? "row_not_yet" : "already_titled" });
+                    deps.metrics?.inc("session_title_total", { outcome: after.unreadable ? "probe_failed" : after.state === "none" ? "row_not_yet" : "already_titled" });
                     return;
                 }
                 deps.metrics?.inc("session_title_total", { outcome: "set" });

package/dist/task-settings.d.ts

@@ -70,6 +70,41 @@ export declare function coercePermissionMode(raw: unknown): SettingsPermissionMo
 /** 五模式闭集的**严格**读法([ref] ④:`/v1/capabilities?permissionMode=` 查询串用它 —— 读面对词表外的值 400,
  *  不走上面那条给 resume 重放留的 `default` 宽臂)。上面的宽读只是本函数外再包一层折叠,词表单点在此。 */
 export declare function coercePermissionModeStrict(raw: unknown): SettingsPermissionMode | undefined;
+/**
+ * S-433 —— 一份**被批准的计划**之后,这条会话继续用的 permission mode(`plan_review` 决裁体的
+ * `permissionModeAfter`)。core 的契约句是 `present-plan-tool.js`:「If the plan is approved, the run
+ * continues (and any read-only restriction is lifted)」—— 而 core 顶层 resume 把宿主的续跑配置**整体**
+ * 展开成新一段 spec、不继承停靠点的 `handsReadOnly` / `enablePlanMode`(`runtask.ts`),所以「松开」这
+ * 件事的属主在**本仓装配续跑配置的那一处**。批准者要说的正是「松到哪一档」。
+ *
+ * 🔴 **闭集为什么只有这两个词**:它是 CC `ExitPlanMode` 三选卡上那两张 Yes 卡(「Yes, and auto-accept
+ * edits」/「Yes, and manually approve edits」)的对位;`plan` 自己(= 不松开)由 `edit`/`reject` 两个
+ * 决裁表达,`bypassPermissions` / `auto` 不在这张卡上 —— 一个批准动作不该顺带把部署的 ask 面整个关掉。
+ *
+ * 🔴 **不手抄词表**:`satisfies readonly SettingsPermissionMode[]` 让「本表的成员必须仍是本仓受理的
+ * 模式词」成为**编译期**事实 —— 五词表某天改名/删词,这里就是红的,而不是静默留一个没人认的词。
+ */
+export declare const PLAN_APPROVE_PERMISSION_MODES_AFTER: readonly ["default", "acceptEdits"];
+/** {@link PLAN_APPROVE_PERMISSION_MODES_AFTER} 的类型形(值表单点,类型从值派生 —— 两处各写一份就会漂)。 */
+export type PlanApprovePermissionModeAfter = (typeof PLAN_APPROVE_PERMISSION_MODES_AFTER)[number];
+/** S-433 值闭集判据(wire 门用)。**宽臂一个都没有**:词表外的值 400 响亮拒 —— 这一位选的是批准之后
+ *  模型有没有手,把一个拼错的词折成任何一档都是安全轴上的静默降级([ref]「无静默 fail-open」)。 */
+export declare function isPlanApprovePermissionModeAfter(raw: unknown): raw is PlanApprovePermissionModeAfter;
+/**
+ * S-433 —— **一条已持久化的提交体的生效 permission mode**,单点。
+ *
+ * 它只是把 {@link effectivePermissionMode} 与「拿哪一份 settings 去问」这**一对**绑在一起:后者是
+ * `parseTaskSettings(body.settings)`(resume 重放共用的宽容解析层)。两处各写一遍这一对,就会在
+ * 「某天改成用别的 settings 去算生效模式」的那一拍静默分家 —— 而分家在这条轴上的形态是「wire 门说
+ * 这条任务不是只读起步、装配腿却按只读起步重建」,两个 4xx/行为各说各话,tsc 一声不响。
+ *
+ * ⚠️ 射程:**只管持久化体这一路**。首跑那一路的生效模式在 `boot/resolve-spec.ts` 单点算(它吃的是
+ * 场景折叠后的 settings),本函数刻意不去冒充那一处的属主。
+ */
+export declare function storedBodyPermissionMode(body: {
+    permissionMode?: unknown;
+    settings?: unknown;
+}): SettingsPermissionMode | undefined;
 /** L2 ultracode ([ref]): the effective `thinking` level given the explicit `reasoningEffort` and the ultracode
  *  preset. ultracode FLOORS at the "ultra" tier — core's single source `resolveReasoningProfile("ultra").thinking`
  *  (= "max"), never a hardcoded literal — so an explicit higher tier still wins (none exists above max today;

package/dist/task-settings.js

@@ -16,6 +16,13 @@ export function coercePermissionModeStrict(raw) {
         return raw;
     return undefined;
 }
+export const PLAN_APPROVE_PERMISSION_MODES_AFTER = ["default", "acceptEdits"];
+export function isPlanApprovePermissionModeAfter(raw) {
+    return PLAN_APPROVE_PERMISSION_MODES_AFTER.includes(raw);
+}
+export function storedBodyPermissionMode(body) {
+    return effectivePermissionMode(body, parseTaskSettings(body.settings).settings);
+}
 export function effectiveThinking(reasoningEffort, ultracode) {
     const explicit = isThinkingLevel(reasoningEffort) ? reasoningEffort : undefined;
     if (!ultracode)

package/dist/tool-approval.d.ts

@@ -420,6 +420,22 @@ export interface LivePendingRow {
      *  `approval-content-kind.ts`,与 durable 两读面 / core summarize 面同词,OMIT 契约同族)。
      *  缺席 = 普通工具 ask。展示/分诊分型用,永不参与决议路由。 */
     contentKind?: "content_ask";
+    /**
+     * 🔴 S-454(P1;cli L-397 / 板 [ref]):这只 ask **本来会 emit 的那只活卡帧**。
+     *
+     * 值 = {@link PendingApproval.frame} 的**引用** —— `askBroadcast` 里那一处唯一构造(已过
+     * `redactDeep` / 字节帽 / [ref] 窗三键补写)的**同一个对象**,悬挂与可达两条路共用它。⇒ 这一格
+     * **不是**为列表另算的第二份卡投影:一处脱敏属主不变、零第二脱敏面,「wire 帧与列表行同一份判据」
+     * 是结构事实而不是两处各算一遍的巧合(同 `card_json` 与帧的关系)。
+     *
+     * 🔴 为什么本行不再守「input/args 不上列表」那条窄化:那条纪律的理由原文是「详情走流帧」——
+     * 而**悬挂 ask 永远没有流帧**(铸造时刻零投递目标,`suspended`),对它这条理由结构上不成立。
+     * 消费方要出卡就必须在这一行上拿到卡体,否则「列得到但渲不出」。一视同仁给**全部** live 行
+     * (规则集不因 `suspended` 分叉:有活流的 ask 多带一份它自己那张卡的副本无害)。
+     *
+     * 缺席 = 老 server(7.86.0 及以前);本服务自 7.87.0 起**恒在场**(条目上是必填格)。恒不铸 `null`。
+     */
+    frame?: ToolApprovalFrame;
 }
 export interface ToolApprovalRunContext {
     taskId: string;
@@ -1309,8 +1325,12 @@ export declare class ToolApprovalCoordinator {
      *  方法体的逐字搬运([ref] 车2 拆分,行为零改动)。 */
     private finishRespond;
     /** [ref]([ref] 案):live pending 的**列表读面**——`GET /v1/approvals` 响应第二顶层键 `livePending`
-     *  的唯一数据源。纯读投影,零锁/零结算语义;行键集刻意窄(**input/args 不上列表**,不开第二个脱敏
-     *  面;详情走流帧)。`scope` 与 durable 面同一表达式:`undefined` = operator 全量(含 owner null 的
+     *  的唯一数据源,**同时**是 `/v1/approvals/stream` 的 live 半场 diff 源(推与拉必须同源:feed 收到
+     *  `live_pending` 事件就会去 `list()`,两处各读各的会给出一条列不出来的事件)。纯读投影,零锁/零结算
+     *  语义。
+     *  🔴 **S-454 起行上带整只活卡帧**(`frame`,见 {@link LivePendingRow.frame}):旧文那句「input/args
+     *  不上列表,详情走流帧」对**悬挂 ask 结构上不成立**(它永远没有流帧),而 `frame` 是 `askBroadcast`
+     *  那一处构造的同一个对象 ⇒ 仍然只有**一个**脱敏属主、零第二投影。`scope` 与 durable 面同一表达式:`undefined` = operator 全量(含 owner null 的
      *  条目),串 = 只见 `owner === scope` 的条目(null-owner 行对 principal 不可见,fail-closed——
      *  宁少列不超范围;`"__none__"` 未鉴权哨兵自然恒空)。行的 `approvalId` 就是 `respond()` 收的 id
      *  (同源可达,[ref] 判据);`expiresAtMs` 照抄登记时单点铸定的窗死线([ref] 三键同一个数)。 */

package/dist/tool-approval.js

@@ -1361,6 +1361,7 @@ export class ToolApprovalCoordinator {
             ...(reachability === "unreached" ? { suspended: true } : {}),
             ...(child ? { originTaskId: req.sourceTaskId } : primary ? { targetCtxs: new Set(aliveCtxs), onTargetGone } : {}),
             ...(origin.sessionId ? { sessionId: origin.sessionId } : {}),
+            frame,
             toolName: req.toolName,
             registeredAtMs: Date.now(),
             expiresAtMs: persistedExpiresAtMs,
@@ -1981,6 +1982,7 @@ export class ToolApprovalCoordinator {
                 ...(e.governanceForced ? { governanceForced: true } : {}),
                 ...(e.originTaskId !== undefined ? { fromSubagent: true, originTaskId: e.originTaskId } : {}),
                 ...(contentKind !== undefined ? { contentKind } : {}),
+                frame: e.frame.approvalId === id ? e.frame : { ...e.frame, approvalId: id },
             });
         }
         return rows;

package/dist/trace/core-keyset-guard.d.ts

@@ -21,7 +21,7 @@ import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, Ros
 import type { ToolApprovalFrame } from "../tool-approval.js";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。
  *  🔴 **导出**([ref] U1/U2):本仓「词表闭集,未处置成员=编译红」的钉法只许有**一个**形 ——
- *  `observability/run-terminal-log.ts` 的三张叶表 + 结果顶层键表用同一只断言,而不是各自再抄一份
+ *  `observability/run-terminal.ts` 的三张叶表 + 结果顶层键表用同一只断言,而不是各自再抄一份
  *  `type X<T extends never> = T`(抄一份就是第二个写者,两处哪天分岔谁都发现不了)。
  *  本文件只有类型、不产 JS,所以被 `import type` 引用不新增任何运行期边。 */
 export type AssertAllKeysHandled<T extends never> = T;

package/dist/trace/ledger-events.d.ts

@@ -74,7 +74,7 @@ export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" |
  * 🔴 **park 行名的运行时闭集**(合并重扫 [4])。
  *
  * 此前这两个词在仓里有**三处**并列的字面量:`ledger-sink.ts` 的 `appendParked` 形参与 `onDone` 的分诊、
- * 以及 `observability/run-terminal-log.ts` 的脱敏臂。`LedgerEventType` 只是类型联合、运行期取不到,
+ * 以及 `observability/run-terminal.ts` 的脱敏臂。`LedgerEventType` 只是类型联合、运行期取不到,
  * 所以脱敏臂只能自己再抄一份 —— 而抄的那一份**加词不红**:仓里/引擎加第三个 park 词并登记进
  * `LedgerEventType` 之后,`appendParked` 与 resume 腿的动态首参照写照落,回放时那一行的
  * `gate.riskDescriptor.summary` 明文,脱敏臂一声不吭。

package/dist/trace/project.d.ts

@@ -116,7 +116,7 @@ export type TraceBlock = {
  * 那一案 —— 七个调用点只有三个记得拼,**漏的正是 resume 腿与 ledger-sink 落盘这两处**。
  *
  * ## 🔴 脱敏**不在这里**(写口不是脱敏属主)
- * 两行的字节由模型写,必须脱 —— 但脱敏口是 `observability/run-terminal-log.ts` 的
+ * 两行的字节由模型写,必须脱 —— 但脱敏口是 `observability/run-terminal.ts` 的
  * `redactLedgerEventData`:三孪生 store 的 `appendEvent` 落库前 + `GET /v1/runs/:id/events` 读面各过一次
  * (幂等)。理由与 park 行逐字同源(`trace/ledger-sink.ts` 的 `appendParked` 顶注是那条规矩的属主):
  * 写口脱 = 一个语义面上两个写者,且**盖不住存量行**(升级前落下的明文 `text` 行每次重连照样回放)。

package/dist/trace/project.js

@@ -1,4 +1,4 @@
-import { redactErrorMessage, redactModelText } from "../observability/run-terminal-log.js";
+import { redactErrorMessage, redactModelText } from "../observability/run-terminal.js";
 import { MCP_DELIVERY_VERDICTS, screenGateOutcome, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
 import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";

package/dist/trace/redact.d.ts

@@ -24,7 +24,7 @@
  * 而**模型自己写的**那一份(`TaskResult.result` / `TaskResult.salvagedOutput` / 账本 `text` 行)整条逐字
  * 上 wire —— 工具结果送模路径给的是原文,模型把里面的凭据**逐字引用**进答复,那一份就绕过了本模块。
  * 现在三面与 CoT(账本 `reasoning` 行)走**同一只** `redactSecrets`、同一张替换串表:零第二只脱敏器、
- * 零 per-face 开关、零体量上限。**装载口只有一只** —— `observability/run-terminal-log.ts` 的
+ * 零 per-face 开关、零体量上限。**装载口只有一只** —— `observability/run-terminal.ts` 的
  * `redactModelText`(四座同调:结果两叶经 `redactTerminalResult`,账本两行经 `redactLedgerEventData`);
  * 它定的是**写回**判据(认出凭据形才改字节、抛则占位),不是第二张规则表。
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.85.0",
+  "version": "7.87.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.22.0",
+    "@sema-agent/core": "7.23.0",
     "@sema-agent/settings-schema": "2.1.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",