@sema-agent/server 7.92.1 → 7.93.0

package/dist/http/routes/rules.js

@@ -3,7 +3,7 @@ import { sendJson, sendError, httpErrorCode } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import { createLogger } from "../../observability/logger.js";
-import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, sameWireRuleIdentity, serializeRuleScope } from "../../rules-consent.js";
+import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
 import { CONTROL_AND_BIDI_CHARS } from "../../text-bidi.js";
 import { HttpError } from "../../security.js";
 import { MAX_RULE_TEXT_CHARS, RULE_BEHAVIORS } from "@sema-agent/core";
@@ -246,6 +246,40 @@ async function handleRuleList(res, search, caller, lane, operatorPrincipals) {
         : undefined;
     sendJson(res, 200, { rules: page, rev: listing.rev, ...(nextCursor !== undefined ? { nextCursor } : {}) });
 }
+function sendRuleWriteFailure(res, verb, committed) {
+    switch (verb) {
+        case "write":
+            switch (committed) {
+                case "no":
+                    sendError(res, 503, "state.rule_write_failed", "this rule was not written and nothing landed in the store — send the same request again", { committed });
+                    return;
+                case "unknown":
+                    sendError(res, 503, "state.rule_write_failed", "this write may or may not have landed — reconcile with GET /v1/rules before sending it again", { committed });
+                    return;
+                default: {
+                    const unknownWord = committed;
+                    throw new Error(`unknown rule-write committed word: ${JSON.stringify(unknownWord)}`);
+                }
+            }
+        case "revoke":
+            switch (committed) {
+                case "no":
+                    sendError(res, 503, "state.rule_remove_failed", "this rule was not revoked and nothing landed in the store — send the same request again", { committed });
+                    return;
+                case "unknown":
+                    sendError(res, 503, "state.rule_remove_failed", "this revocation may or may not have landed — reconcile with GET /v1/rules before sending it again", { committed });
+                    return;
+                default: {
+                    const unknownWord = committed;
+                    throw new Error(`unknown rule-remove committed word: ${JSON.stringify(unknownWord)}`);
+                }
+            }
+        default: {
+            const unknownVerb = verb;
+            throw new Error(`unknown rule write verb: ${JSON.stringify(unknownVerb)}`);
+        }
+    }
+}
 async function handleRuleWrite(res, rawBody, caller, lane, operatorPrincipals) {
     const parsed = RuleIdentityBodySchema.safeParse(rawBody);
     if (!parsed.success) {
@@ -271,7 +305,9 @@ async function handleRuleWrite(res, rawBody, caller, lane, operatorPrincipals) {
     switch (written.status) {
         case "persisted":
         case "no-op":
-            sendJson(res, 200, { status: written.status, rev: written.rev, rule: written.row });
+            sendJson(res, 200, written.row === undefined
+                ? { status: written.status, rev: written.rev, stillLive: written.stillLive }
+                : { status: written.status, rev: written.rev, stillLive: written.stillLive, rule: written.row });
             return;
         case "rejected":
             logger.info("rule write refused", { reason: written.reason, detail: written.detail });
@@ -280,9 +316,9 @@ async function handleRuleWrite(res, rawBody, caller, lane, operatorPrincipals) {
                 detail: written.detail,
             });
             return;
-        case "indeterminate":
-            logger.info("rule write indeterminate", { detail: written.detail });
-            sendError(res, 503, "state.rule_write_failed", "this write could not be confirmed as a standing rule — retry, then reconcile with GET /v1/rules");
+        case "failed":
+            logger.info("rule write failed", { detail: written.detail, committed: written.committed });
+            sendRuleWriteFailure(res, "write", written.committed);
             return;
         default: {
             const unknown = written;
@@ -311,17 +347,17 @@ async function handleRuleRevoke(res, rawBody, caller, lane, operatorPrincipals)
         case "removed":
             sendJson(res, 200, { status: "removed", rev: outcome.rev, stillLive: outcome.stillLive });
             return;
-        case "no-op": {
-            const stillLive = (await lane.listRules(target.principal)).rows.some((r) => sameWireRuleIdentity(r, { behavior: parsed.data.behavior, rule: parsed.data.rule, scope: serializeRuleScope(scope) }))
-                ? "yes"
-                : "no";
-            sendJson(res, 200, { status: "no-op", rev: outcome.rev, stillLive });
+        case "no-op":
+            sendJson(res, 200, { status: "no-op", rev: outcome.rev, stillLive: outcome.stillLive });
             return;
-        }
         case "failed":
-            logger.info("rule revoke failed", { error: outcome.error });
-            sendError(res, 503, "state.rule_remove_failed", "the rule could not be revoked right now — retry, then reconcile with GET /v1/rules");
+            logger.info("rule revoke failed", { error: outcome.error, committed: outcome.committed });
+            sendRuleWriteFailure(res, "revoke", outcome.committed);
             return;
+        default: {
+            const unknown = outcome;
+            throw new Error(`unknown rule revoke outcome: ${JSON.stringify(unknown)}`);
+        }
     }
 }
 export const RULES_ROUTES = [

package/dist/http/routes/runs.js

@@ -2,7 +2,7 @@ import { persistedPlaneOf } from "../../terminal.js";
 import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventData, redactTerminalResult } from "../../observability/run-terminal.js";
 import { isModelTextLedgerEventType } from "../../trace/ledger-events.js";
 import { z } from "zod";
-import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer } from "@sema-agent/core";
+import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS } from "@sema-agent/core";
 import { isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-sql.js";
 import { redactSecrets } from "../../trace/redact.js";
@@ -1058,8 +1058,9 @@ export async function handleRunVerbs(req, res, match, ctx) {
         const g14 = (() => {
             const d = out.details;
             const replay = d?.details?.replay;
-            if (replay === "cursor" || replay === "full")
+            if (typeof replay === "string" && TASK_OUTPUT_REPLAY_KINDS.includes(replay)) {
                 return { cursorSemantics: replay };
+            }
             return {};
         })();
         sendJson(res, 200, { taskId: runId, target, content: out.content, output: out.details, ...g14 });

package/dist/http/routes/session-sync.js

@@ -1,11 +1,11 @@
 import { once } from "node:events";
 import { randomBytes, createHash } from "node:crypto";
-import { sessionLogDigest, sessionLogDigestsComparable, StreamingImportValidator, SessionError, SessionPolicyError, validateFileHistoryExport } from "@sema-agent/core";
+import { sessionLogDigest, sessionLogDigestsComparable, StreamingImportValidator, SessionError, validateFileHistoryExport } from "@sema-agent/core";
 import { StringDecoder } from "node:string_decoder";
 import { exportSessionManifest, fileHistoryImportFace, replayFileHistory, replayPolicyRecords, overwriteWipeIncapable, wipeSessionAttendants } from "../../session-sync.js";
 import { classifySyncRelationshipByIds, SyncConflictError } from "../../session-sync-kernel.js";
 import { isUuidShape } from "../../security.js";
-import { sendJson, sendError, msg } from "../send.js";
+import { sendJson, sendError, sendSessionPolicyError, msg } from "../send.js";
 import { buildDisplaySafeUrl } from "../../trace/redact.js";
 import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 const SYNC_BLOB_MAX_BYTES = 64 * 1024 * 1024;
@@ -13,7 +13,7 @@ const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
 const SYNC_IMPORT_BATCH = 500;
 import { SHA256_HEX_RE } from "../../digest-form.js";
 import { assertNever } from "../route-ctx.js";
-import { readSessionRulesRecords, describeSessionRulesRecordProblem, sessionPolicyErrorHttp } from "../../session-policy-wire.js";
+import { readSessionRulesRecords, describeSessionRulesRecordProblem } from "../../session-policy-wire.js";
 export function createSessionSyncLocal() {
     const pendingStagings = new Map();
     const importLeases = new Map();
@@ -74,7 +74,15 @@ export async function handleSessionSync(req, res, match, ctx) {
             if (match.decl.id === "session-sync-manifest") {
                 if (!pullGateOk())
                     return;
-                const out = await exportSessionManifest(sessionId, deps.backend);
+                let out;
+                try {
+                    out = await exportSessionManifest(sessionId, deps.backend);
+                }
+                catch (e) {
+                    if (sendSessionPolicyError(res, e))
+                        return;
+                    throw e;
+                }
                 if (out === null) {
                     sendError(res, 404, "not_found.session", "session not found");
                     return;
@@ -281,8 +289,16 @@ export async function handleSessionSync(req, res, match, ctx) {
                         }
                     }
                     const opOk = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config.operatorPrincipals);
-                    if (deps.sessionPolicyStore)
-                        await replayPolicyRecords(deps.sessionPolicyStore, sessionId, policy, opOk);
+                    if (deps.sessionPolicyStore) {
+                        try {
+                            await replayPolicyRecords(deps.sessionPolicyStore, sessionId, policy, opOk);
+                        }
+                        catch (e) {
+                            if (sendSessionPolicyError(res, e))
+                                return;
+                            throw e;
+                        }
+                    }
                     const importingP = scope.fleetWide ? (owner ?? null) : scope.gateOwner;
                     if (deps.resumeAnchorStore)
                         for (const a of anchors)
@@ -499,13 +515,9 @@ export async function handleSessionSync(req, res, match, ctx) {
                         sendError(res, 409, "conflict", "sync conflict", { relation: e.relation });
                         return;
                     }
-                    if (e instanceof SessionPolicyError) {
-                        cleanupStaging(stagingId);
-                        const h = sessionPolicyErrorHttp(e.code);
-                        sendError(res, h.status, h.errorCode, e.message);
-                        return;
-                    }
                     cleanupStaging(stagingId);
+                    if (sendSessionPolicyError(res, e))
+                        return;
                     throw e;
                 }
                 return;

package/dist/http/routes/sessions.js

@@ -1,12 +1,12 @@
-import { materializeA2aTools, materializeMcpTools, sanitizePathComponent, SessionPolicyError } from "@sema-agent/core";
+import { materializeA2aTools, materializeMcpTools, sanitizePathComponent } from "@sema-agent/core";
 import { a2aForScenario, mcpForScenario } from "../../config-center/facade.js";
 import { isUuidV7, isUuidShape, legacyUnownedSessionOk } from "../../security.js";
 import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
-import { readSessionPermissionRules, describeSessionPermissionRulesProblem, sessionPolicyErrorHttp } from "../../session-policy-wire.js";
-import { sendJson, sendError, sseHeaders } from "../send.js";
+import { readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
+import { sendJson, sendError, sendSessionPolicyError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 const MCP_STATUS_TTL_MS = 5_000;
@@ -731,7 +731,14 @@ export async function handleSessions(req, res, match, ctx) {
             }
             const target = owner;
             if (match.decl.id === "session-policy-get") {
-                sendJson(res, 200, { rules: (await store.getRules(sessionId, target)) ?? { rev: 0 } });
+                try {
+                    sendJson(res, 200, { rules: (await store.getRules(sessionId, target)) ?? { rev: 0 } });
+                }
+                catch (e) {
+                    if (sendSessionPolicyError(res, e))
+                        return;
+                    throw e;
+                }
                 return;
             }
             let body;
@@ -767,11 +774,8 @@ export async function handleSessions(req, res, match, ctx) {
                 sendJson(res, 200, { rules: stored });
             }
             catch (e) {
-                if (e instanceof SessionPolicyError) {
-                    const h = sessionPolicyErrorHttp(e.code);
-                    sendError(res, h.status, h.errorCode, e.message);
+                if (sendSessionPolicyError(res, e))
                     return;
-                }
                 throw e;
             }
             return;

package/dist/http/routes/tasks.js

@@ -1,7 +1,7 @@
 import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal.js";
-import { runWithVerification, runCascade, uuidv7, terminalProjection } from "@sema-agent/core";
+import { runWithVerification, runCascade, uuidv7 } from "@sema-agent/core";
 import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, resumeAtHttpStatus, HEARTBEAT_MS } from "../../runs.js";
-import { stripResumeToken } from "../../terminal.js";
+import { sealResultForExit, outwardPlane } from "../../terminal.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../../fleet/subagent-tail-bus.js";
@@ -47,7 +47,7 @@ function sendSubmitResult(res, resp) {
         : raw;
     sendJson(res, 200, body);
 }
-const MULTI_ATTEMPT_NO_EVENT_CHANNEL_NOTICE = "verify / cascade ran with their normal multi-attempt semantics, but the synchronous /v1/tasks endpoint has no event channel — no status/progress frames exist to replay on this shape. For observable events submit via POST /v1/runs and read GET /v1/runs/:id/events.";
+const MULTI_ATTEMPT_NO_EVENT_CHANNEL_NOTICE = "verify / cascade ran with their normal multi-attempt semantics, but the synchronous /v1/tasks endpoint has no event channel — no status/progress frames exist to replay on this shape. For status / progress / delegated-child frames and the terminal done, submit via POST /v1/runs and read GET /v1/runs/:id/events; note that verify / cascade legs carry no per-turn stream there either (no wiring_manifest / text / turn_end frames — the engine runs those legs as result-returning attempts).";
 export async function handleTasks(req, res, match, ctx) {
     const { deps } = ctx;
     const { idemCache, inflightRuns, cancelledViaVerb, steerableRuns, counters } = ctx.registry;
@@ -58,7 +58,7 @@ export async function handleTasks(req, res, match, ctx) {
     const noteRunOutcome = (r) => {
         if (!r?.terminal)
             return;
-        const plane = terminalProjection(r.terminal);
+        const plane = outwardPlane(r.terminal);
         reqState.runStatus = plane.status;
         if (plane.errorCode)
             reqState.runErrorCode = plane.errorCode;
@@ -421,7 +421,7 @@ export async function handleTasks(req, res, match, ctx) {
                                     userMsgEntryId = ev.entryId;
                                 const cancelVerbAtDone = ev.type === "done" && durableTaskId !== undefined && cancelledViaVerb.has(durableTaskId);
                                 if (ev.type === "done") {
-                                    finalResult = redactTerminalResult(stripResumeToken(await graftParkToolCallId(ev.result, deps.checkpointStore)));
+                                    finalResult = redactTerminalResult(sealResultForExit(await graftParkToolCallId(ev.result, deps.checkpointStore)));
                                     if (durableTaskId && finalResult)
                                         finalResult = { ...finalResult, taskId: durableTaskId };
                                     if (cancelVerbAtDone && finalResult !== undefined) {
@@ -430,7 +430,7 @@ export async function handleTasks(req, res, match, ctx) {
                                     finalizeTaskResult(ev.result, principal, prepared.spec.objective, prepared.spec.sessionId);
                                     noteRunOutcome(finalResult);
                                     putRewindAnchor();
-                                    settleFleet(terminalProjection(finalResult.terminal).status, fleetRunResiduals(finalResult));
+                                    settleFleet(outwardPlane(finalResult.terminal).status, fleetRunResiduals(finalResult));
                                     if (ledgerSink && finalResult) {
                                         if (usageKey && deps.modelUsage && deps.runStore && durableTaskId) {
                                             const rs2 = deps.runStore;
@@ -650,7 +650,7 @@ export async function handleTasks(req, res, match, ctx) {
                         }, withApproval)
                         : withApproval());
                     if (durableTaskId && deps.runStore) {
-                        const finalPlane = finalResult ? terminalProjection(finalResult.terminal) : undefined;
+                        const finalPlane = finalResult ? outwardPlane(finalResult.terminal) : undefined;
                         if (finalPlane?.status === "suspended" && deps.checkpointStore)
                             await deps.runStore.setSuspended(durableTaskId);
                         else if (finalPlane?.status === "needs_review" && deps.checkpointStore)
@@ -717,7 +717,7 @@ export async function handleTasks(req, res, match, ctx) {
                                         ledgerTerminal = true;
                                         await ledgerSink.onDone(finalResult).catch(() => undefined);
                                     }
-                                    const retryPlane = terminalProjection(finalResult.terminal);
+                                    const retryPlane = outwardPlane(finalResult.terminal);
                                     await deps.runStore.setTerminal(durableTaskId, retryPlane.status, finalResult, retryPlane.errorMessage ?? null);
                                     settleFleet(retryPlane.status, fleetRunResiduals(finalResult));
                                 }
@@ -860,15 +860,15 @@ export async function handleTasks(req, res, match, ctx) {
                 }
                 const resumeAtStatus = resumeAtHttpStatus(result);
                 if (resumeAtStatus) {
-                    const resumeAtPlane = terminalProjection(result.terminal);
+                    const resumeAtPlane = outwardPlane(result.terminal);
                     if (durableTaskId && deps.runStore)
-                        await deps.runStore.setTerminal(durableTaskId, "failed", stripResumeToken(result), resumeAtPlane.errorMessage ?? null);
+                        await deps.runStore.setTerminal(durableTaskId, "failed", sealResultForExit(result), resumeAtPlane.errorMessage ?? null);
                     const retryAfterSec = resumeAtPlane.errorCode === "memory.admission_required" && result.retryAfterMs !== undefined
                         ? Math.max(1, Math.ceil(result.retryAfterMs / 1000))
                         : undefined;
                     return { status: resumeAtStatus, body: { errorCode: resumeAtPlane.errorCode, error: redactErrorMessage(resumeAtPlane.errorMessage) ?? "resume-at failed", ...(retryAfterSec !== undefined ? { retryAfterSec } : {}) } };
                 }
-                const syncPlane = terminalProjection(result.terminal);
+                const syncPlane = outwardPlane(result.terminal);
                 if (syncPlane.status === "suspended" && deps.checkpointStore && deps.runStore && prepared.spec.sessionId) {
                     if (durableTaskId)
                         await deps.runStore.setSuspended(durableTaskId);
@@ -880,10 +880,10 @@ export async function handleTasks(req, res, match, ctx) {
                     return { status: 200, body: withSyncSubmitKeys({ taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "needs_review" }) };
                 }
                 if (durableTaskId && deps.runStore)
-                    await deps.runStore.setTerminal(durableTaskId, syncPlane.status, stripResumeToken(result), syncPlane.errorMessage ?? null);
+                    await deps.runStore.setTerminal(durableTaskId, syncPlane.status, sealResultForExit(result), syncPlane.errorMessage ?? null);
                 finalizeTaskResult(result, principal, prepared.spec.objective, prepared.spec.sessionId);
                 noteRunOutcome(result);
-                return { status: 200, body: withSyncSubmitKeys(redactTerminalResult(stripResumeToken(result))) };
+                return { status: 200, body: withSyncSubmitKeys(redactTerminalResult(sealResultForExit(result))) };
             };
             const resp = await idemCache.run(idemKey, async () => withRunReceipt(await runSyncSubmitLeg()), (r) => r.status < 400);
             sendSubmitResult(res, resp);

package/dist/http/send.d.ts

@@ -60,5 +60,16 @@ export declare function sendError(res: ServerResponse, status: number, errorCode
  *  throw 点里只有 3 个带。为了让「errorCode 恒在」在这些站点也成立(而不是靠豁免表放行),按**状态码**
  *  给一个诚实的粗码:它只声明「这类拒绝」,不冒充比 throw 点更细的语义。带 `code` 的 throw 点原样优先。 */
 export declare function httpErrorCode(status: number, code?: string): string;
+/**
+ * 🔴 B1 / S-535 —— `SessionPolicyError` → 应答,经 {@link sessionPolicyErrorHttp} 那**一只**映射
+ * (`src/session-policy-wire.ts`)。回 `true` = 已应答,调用点 `return`。
+ *
+ * 为什么是一只共享腿而不是每个站点一句 `instanceof`:映射本身早就收成一处了,而**咨询它的站点**只有两条
+ * **写**腿 —— 偏偏 core 7.25.0 那个新词 `corrupt` 是在**读**上抛出来的(店读不出它自己写的那一行:
+ * S-529 的两道读回拒 + C1 的体形拒)。于是 `GET /v1/sessions/:id/policy` 与 2c 的 manifest 导出腿把它交给了
+ * 域外通用臂 ⇒ `500 internal.error "internal error"`:码丢,连带**修复路径**也丢(同一行 `PUT` 却答
+ * `500 corrupt` 并点名那一列)。一只腿之后,新站点只会忘记调它,不会再各自发明一份映射。
+ */
+export declare function sendSessionPolicyError(res: ServerResponse, e: unknown): boolean;
 export declare function msg(e: unknown): string;
 //# sourceMappingURL=send.d.ts.map

package/dist/http/send.js

@@ -1,3 +1,5 @@
+import { SessionPolicyError } from "@sema-agent/core";
+import { sessionPolicyErrorHttp } from "../session-policy-wire.js";
 export const SSE_RESPONSE_MARK = Symbol("sema.http.sse-response");
 export function isSseResponse(res) {
     return res[SSE_RESPONSE_MARK] === true;
@@ -35,6 +37,13 @@ export function httpErrorCode(status, code) {
         default: return status >= 500 ? "internal.error" : "request.rejected";
     }
 }
+export function sendSessionPolicyError(res, e) {
+    if (!(e instanceof SessionPolicyError))
+        return false;
+    const h = sessionPolicyErrorHttp(e.code);
+    sendError(res, h.status, h.errorCode, e.message);
+    return true;
+}
 export function msg(e) {
     return e instanceof Error ? e.message : String(e);
 }

package/dist/http/server.js

@@ -1,6 +1,7 @@
 import http from "node:http";
+import { outwardPlane } from "../terminal.js";
 import { redactHead } from "../observability/run-terminal.js";
-import { validatePendingSteer, terminalProjection } from "@sema-agent/core";
+import { validatePendingSteer } from "@sema-agent/core";
 import {} from "../config-center/facade.js";
 import { HttpError } from "../security.js";
 import {} from "../memory-sync.js";
@@ -117,7 +118,7 @@ export function createHttpServer(rawDeps) {
         return deps.runnerFor?.(spec) ?? deps.runner;
     }
     function recordTaskResult(result) {
-        const plane = terminalProjection(result.terminal);
+        const plane = outwardPlane(result.terminal);
         deps.metrics?.inc("tasks_total", { status: plane.status });
         if (result.stats.tokens)
             deps.metrics?.inc("task_tokens_total", {}, result.stats.tokens);

package/dist/http/wire-types.d.ts

@@ -6,7 +6,7 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, McpServerSpec, SkillSpec } from "@sema-agent/core";
+import type { A2aServerSpec, AgentDefinition, ApproverPosture, McpServerSpec, SkillSpec } from "@sema-agent/core";
 import type { SettingsPermissionMode } from "../task-settings.js";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 export interface TaskRequestBody {
@@ -316,6 +316,22 @@ export interface TaskRequestBody {
      *  `SETTINGS_PERMISSION_MODES`(受理腿 `isSettingsPermissionMode` 与两句 400 文案同读那一份)。
      *  改前这里是第 6 份手抄的五词联合 —— 加/退一个模式时 wire 型面与受理腿会各走各的。 */
     permissionMode?: SettingsPermissionMode;
+    /**
+     * **#1000**(core 7.26.0 `TaskSpec.approverPosture`;CC-116 装配口)—— 宿主对这个 run 的**审批姿态声明**:
+     * 「这些卡由我自己自动答」。一个词(`"bypass"`),闭集属主在 core(`ApproverPosture` / `APPROVER_POSTURES`)。
+     *
+     * 🔴 **它不授权任何东西,也不是一只门**(core 头注逐字:"a statement about who answers this run's approval
+     * cards, never an instruction to the gate";引擎只把它**渲**给模型,没有任何裁决腿读它)。所以它与
+     * {@link permissionMode} 的 `"bypassPermissions"` **不是**一回事,也不能互相派生:后者选的是**门的形状**
+     * (且只能收紧、deny-wins),前者只说「谁来答卡」。两者在语义上同族,声明它而不开 `bypassPermissions`
+     * 只是对模型说了一句与实际不符的话 —— 见契约文档那一段的「谁受伤」。
+     *
+     * 🔴 **本仓零判据、原样过境**(`boot/resolve-spec.ts` 写点):词的拒绝逻辑属引擎
+     * (`refuseInvalidApproverPosture` 响亮拒一个不认识的词),server **不加第二道门** —— 在下游再判一次就是
+     * 同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加第二个词就会被静默 400 掉。
+     * 型也从 core 的 `ApproverPosture` 派生(不抄字面联合)。
+     */
+    approverPosture?: ApproverPosture;
     /** MF-30 memory PAUSE (shell-host contract, option B per-request — clay 2026-06-27): `false` makes THIS run
      *  read-only over long-term memory (`TaskSpec.memory.writeScope:null` — the [ref] memory ENGINE materializes/
      *  reads but its harvest commits nothing). Absent/`true` ⇒ normal read+write. The shell's `/memory` pause carries

package/dist/leader/fanout.js

@@ -1,6 +1,6 @@
-import { terminalProjection } from "@sema-agent/core";
+import {} from "@sema-agent/core";
 import { redactErrorMessage, redactWorkerReportError } from "../observability/run-terminal.js";
-import { pausedCauseOf } from "../terminal.js";
+import { pausedCauseOf, outwardPlane } from "../terminal.js";
 class Semaphore {
     max;
     active = 0;
@@ -68,7 +68,7 @@ export async function fanOut(subtasks, opts) {
             let report;
             try {
                 const result = await stream.result();
-                const plane = terminalProjection(result.terminal);
+                const plane = outwardPlane(result.terminal);
                 report = { ...base, status: mapStatus(result.terminal), stats: result.stats, ...(plane.errorMessage ? { error: redactErrorMessage(plane.errorMessage) ?? "" } : {}) };
             }
             catch (e) {

package/dist/leader/leader.js

@@ -2,8 +2,8 @@ import { fanOut } from "./fanout.js";
 import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { pullDiff } from "./diffout.js";
 import { mergeBranches } from "./merge.js";
-import { Runner, runWithVerification, resumeWithVerification, terminalProjection } from "@sema-agent/core";
-import { pausedCauseOf } from "../terminal.js";
+import { Runner, runWithVerification, resumeWithVerification } from "@sema-agent/core";
+import { pausedCauseOf, outwardPlane } from "../terminal.js";
 const MAX_RESUME_SLICES = 200;
 export async function autoResumeOnResource(initial, signal, resume, maxSlices = MAX_RESUME_SLICES) {
     let vr = initial;
@@ -59,7 +59,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                             deps.logger?.info?.("worker_resource_resume", { workerId: w.workerId, slice });
                             return runner.resume(token, { gate: "resource_limit", decision: "continue" }, { ...w.spec, sessionId: w.sessionId, signal });
                         });
-                        const plane = terminalProjection(r.terminal);
+                        const plane = outwardPlane(r.terminal);
                         const paused = pausedCauseOf(r.terminal);
                         if (r.terminal.kind !== "completed") {
                             deps.logger?.warn?.("worker_failed", {
@@ -92,7 +92,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                         deps.logger?.info?.("worker_resource_resume", { workerId: w.workerId, slice });
                         return resumeWithVerification(w.runner, token, { gate: "resource_limit", decision: "continue" }, { ...w.spec, sessionId: w.sessionId, signal }, w.spec.objective ?? "", cfg);
                     });
-                    const vrPlane = terminalProjection(vr.terminal);
+                    const vrPlane = outwardPlane(vr.terminal);
                     deps.logger?.info?.("verify_outcome", { workerId: w.workerId, status: vrPlane.status, verdict: vr.verification.verdict, rounds: vr.verification.rounds, finding: redactHead(vr.verification.findings[0] ?? "", 220) });
                     const pass = vr.terminal.kind === "completed" && vr.verification.verdict === "PASS";
                     const vrPaused = pausedCauseOf(vr.terminal);

package/dist/leader/repair-wire.js

@@ -1,6 +1,6 @@
 import { runRepairLoop, delimitUntrusted, } from "@sema-agent/core";
 import { mkRepairOracle } from "./repair-oracle.js";
-import { terminalProjection } from "@sema-agent/core";
+import { outwardPlane } from "../terminal.js";
 import { redactHead } from "../observability/run-terminal.js";
 function statusForTerminal(t) {
     return t === "fixed" || t === "candidate_only" ? "completed" : "failed";
@@ -52,7 +52,7 @@ async function runRepairLoopForLeaderInner(solo, implSpec, cfg) {
         return { report: { ...base, status: "failed", error: safe }, result: undefined };
     }
     const terminal = result.repairTerminal;
-    const plane = terminalProjection(result.terminal);
+    const plane = outwardPlane(result.terminal);
     const report = {
         ...base,
         status: terminal === undefined ? "failed" : statusForTerminal(terminal),

package/dist/leader/wire.js

@@ -1,4 +1,4 @@
-import { terminalProjection } from "@sema-agent/core";
+import { outwardPlane } from "../terminal.js";
 import { parseNumOrFail } from "../config.js";
 import { execFileSync } from "node:child_process";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
@@ -176,7 +176,7 @@ export function createLeaderRunner(cfg) {
                     })
                         .result();
                     if (res.terminal.kind !== "completed")
-                        throw new Error(`repair round ${round} did not complete (status=${terminalProjection(res.terminal).status})`);
+                        throw new Error(`repair round ${round} did not complete (status=${outwardPlane(res.terminal).status})`);
                     return { costUsd: res.stats?.costMicroUsd !== undefined ? res.stats.costMicroUsd / 1e6 : undefined, note: res.result?.slice(0, 200) };
                 }
                 finally {

package/dist/observability/metrics.js

@@ -1,5 +1,6 @@
 import { DENIED_BY_VALUES } from "@sema-agent/core";
 import { buildPermissionRuleEventsHelp } from "./permission-rule-events.js";
+import { MCP_PROBE_OUTCOMES } from "../capabilities/mcp-probe.js";
 const DEFAULT_BUCKETS = [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30, 60];
 function labelKey(labels) {
     return Object.keys(labels)
@@ -214,6 +215,7 @@ export function createMetrics() {
     m.counter("http_requests_total", "HTTP requests by route/method/status");
     m.histogram("http_request_duration_seconds", "HTTP request duration");
     m.counter("rate_limited_total", "Requests rejected by the rate limiter");
+    m.counter("mcp_probe_total", `No-run MCP status face outcomes by outcome (${MCP_PROBE_OUTCOMES.join("/")} — see src/capabilities/mcp-probe.ts MCP_PROBE_OUTCOMES; rate_limited has TWO causes: the per-identity fixed window AND the replica-wide in-flight cap, which can refuse caller B because of caller A)`);
     m.counter("tasks_total", "Finished tasks by terminal status");
     m.counter("task_tokens_total", "Total model tokens consumed by tasks");
     m.histogram("task_duration_seconds", "Async run wall-clock duration");

package/dist/permission-rule-vocab.d.ts

@@ -1,4 +1,4 @@
-import type { RemoveResult, RuleApprovalRecord, RuleBehavior } from "@sema-agent/core";
+import type { RuleApprovalRecord, RuleBehavior } from "@sema-agent/core";
 /**
  * `PersistedRuleTool` **不再是闭词表**(core 7.9.0 / [ref]):工具名自 core 的**目录**派生
  * (`pathTarget` 声明 ⇒ 路径文法;`Bash` ⇒ 命令文法),型是 `string`。于是本文件对它的处置从
@@ -61,13 +61,13 @@ export declare const RULE_APPROVAL_RECORD_SCHEMA: RuleApprovalRecord["schema"];
  * `"unknown"` = **回答这一问的那次读回没做成** —— 这个域唯一不肯说的那句话是「看不见 ⇒ 没有」,
  * 第三个词就是它的反面。
  *
- * 🔴 **型从 core 的导出型派生,不是抄一份字面联合**:`RemovalLiveness` 本身没有从包根导出
- * (亲验 `dist/index.d.ts`:只导 `RemoveResult`),而 `RemoveResult` 的 removed 臂上就带着它 ⇒ 从那里
- * `Extract` 出来。抄一份 `"yes"|"no"|"unknown"` 的下场与本文件顶注说的那一族一样:core 加第四个词
- * (或改掉某一个)时,抄件不会红。派生形则**编译期**先红在每一处穷举上。
- * (已向 core 请托把这只型放上包根导出面;到货后本行换成直接 import,词表值零变化。)
+ * 🔴 **型从 core 的包根导出接过来,本仓零抄**(core 7.26.0 S-538 ⓐ:`RemovalLiveness` 随请托上了导出面)。
+ * 上一版是 `Extract<RemoveResult, {status:"removed"}>["stillLive"]` —— 那是派生而非手抄(值不会漂),但它把
+ * 一只**独立的闭集**寄生在某一个臂的形状上:core 哪天给 `removed` 臂改名、或让这只词表先在别的臂上落地,
+ * 派生式就会指向一个与词表无关的东西。现在两者同名同源。
+ * 🔴 **运行期词表 `REMOVAL_LIVENESS_WORDS` 刻意不 re-export**:本仓对这三个词零运行期判据(值由 core 在两只
+ * 200 体上原样透传,分支全走编译期穷尽),开一扇没人走的门只会让台账多一行「引用而不消费」的例外。
+ * 哪天真要判「这个串在不在表里」,那时从 core 直接读它。
  */
-export type RemovalLiveness = Extract<RemoveResult, {
-    status: "removed";
-}>["stillLive"];
+export type { RemovalLiveness } from "@sema-agent/core";
 //# sourceMappingURL=permission-rule-vocab.d.ts.map

package/dist/plugins/file-run-store.js

@@ -1,9 +1,9 @@
 import { redactErrorMessage, redactLedgerEventData, redactTerminalResult } from "../observability/run-terminal.js";
+import { outwardPlane } from "../terminal.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
 import { randomBytes } from "node:crypto";
-import { terminalProjection } from "@sema-agent/core";
 import { AppendLog, atomicWriteFile, ensureDir, isProcessLive, processFingerprint, readJsonlRecords, sanitizePathComponent, writeThenLink } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
@@ -371,7 +371,7 @@ export class FileRunStore {
             r.status = status;
             r.result = result;
             r.error = error;
-            r.errorCode = result === null ? null : (terminalProjection(result.terminal).errorCode ?? null);
+            r.errorCode = result === null ? null : (outwardPlane(result.terminal).errorCode ?? null);
             r.updatedAt = new Date();
             this.persist(r);
             pending = {
@@ -382,7 +382,7 @@ export class FileRunStore {
                 resultTaskId: result?.taskId,
                 model: result?.model,
                 errorCode: r.errorCode ?? undefined,
-                errorMessage: (result === null ? undefined : terminalProjection(result.terminal).errorMessage) ?? error ?? undefined,
+                errorMessage: (result === null ? undefined : outwardPlane(result.terminal).errorMessage) ?? error ?? undefined,
                 elapsedMs: Math.max(0, Date.now() - r.createdAt.getTime()),
             };
         }

package/dist/plugins/memory-run-store.js

@@ -1,6 +1,6 @@
 import { redactErrorMessage, redactLedgerEventData, redactTerminalResult } from "../observability/run-terminal.js";
+import { outwardPlane } from "../terminal.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
-import { terminalProjection } from "@sema-agent/core";
 import { notifyRunTerminal } from "../observability/run-terminal.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 export class MemoryRunStore {
@@ -121,7 +121,7 @@ export class MemoryRunStore {
             r.status = status;
             r.result = result;
             r.error = error;
-            r.errorCode = result === null ? null : (terminalProjection(result.terminal).errorCode ?? null);
+            r.errorCode = result === null ? null : (outwardPlane(result.terminal).errorCode ?? null);
             r.updatedAt = new Date();
             pending = {
                 runId: taskId,
@@ -131,7 +131,7 @@ export class MemoryRunStore {
                 resultTaskId: result?.taskId,
                 model: result?.model,
                 errorCode: r.errorCode ?? undefined,
-                errorMessage: (result === null ? undefined : terminalProjection(result.terminal).errorMessage) ?? error ?? undefined,
+                errorMessage: (result === null ? undefined : outwardPlane(result.terminal).errorMessage) ?? error ?? undefined,
                 elapsedMs: Math.max(0, Date.now() - r.createdAt.getTime()),
             };
         }

package/dist/plugins/remote-env-host.d.ts

@@ -134,6 +134,11 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
      * ② 把读拉进来会让 teardown 去等一次可能**永不 settle** 的读(workspace 里的 FIFO / 特殊文件),
      *    把 destroy 挂死 —— 拿一条新的可用性病换一条不存在的正确性收益。
      * 判据因此是一句话:**「可能建路径或改路径的那些面」进在飞集合**,不是「过了 fsReady 的都进」。
+     *
+     * ── 不止文件面(S-541)─────────────────────────────────────────────────────────────────────────
+     * 判据是「会不会建/改路径」,**不是**「在不在 `env` 的文件面上」。后台 shell 的 `launch`(`makeBgDriver`)
+     * 在 spool 根下 `mkdir` 一棵子树,而它整段期间 `bgManager.hasShells()` 还是 false(`shells.set` 在
+     * `await launch(ctx)` 之后)⇒ 同一条竞态的另一张脸,同一只集合治。见那处头注。
      */
     private withInflightFs;
     /**