@sema-agent/server 7.93.7 → 7.95.0

package/dist/hosted-posture.d.ts

@@ -0,0 +1,176 @@
+/**
+ * S-591 / S-564(车LT,7.95.0)—— **「这台部署是不是托管 / 多租」的单一铸点**。
+ *
+ * ## 为什么是一处
+ *
+ * 本仓此前有两条腿各自回答这同一个问题,而且**答得不一样**:
+ *  · 写容纳面的天花板挂在 **core 的 `orgGoverned`** 上(core `prepareHandsReadFace` 读
+ *    `deps.permissionRuleStore?.partitions.org === true`)—— 而本仓从不给那只 provider 传 `org` 分区
+ *    (`boot/stage-04-stores.ts` 的 `createPermissionRuleStoreProvider({ durable })` 只递 durable),
+ *    core 的 provider 按「传了没有」冻出 `partitions` ⇒ 本仓 `org` 恒 `false` ⇒ 那条天花板**结构上不可达**。
+ *    ⚠️ 这句话此前在本仓被抄成「`boot/resolve-spec.ts` 阶段④ 的 `partitions` 字面量」——`src/` 里**没有**
+ *    那个字面量(全仓 `partitions` 的 src 命中全是注释;尺子:同目录 `config` 3721 命中)。手抄的**坐标**
+ *    比手抄的值更难发现烂掉,[ref] 的第一排查点就是它;
+ *  · 能力授予面的赦免挂在 **`requirePrincipal !== true`** 上 —— 但**三条面各有各的谓词,不是一只**
+ *    (异源复核实测,别照「它们都一样」写):
+ *     · `settings.hooks` —— `boot/resolve-spec.ts` 的 hooks 臂,判据**只有** `config.requirePrincipal === true`
+ *       ⇒ 忽略(**不看车道**,任何 `REMOTE_EXEC` 都一样);
+ *     · `additionalDirectories` / `additionalReadDirectories` —— **只有** `cwdHonored`
+ *       (= `provider === "host" ∧ requirePrincipal !== true`);
+ *     · `settings.env` / `cwd` —— `cwdHonored ‖ deviceCwdHonored`,而
+ *       **`deviceCwdHonored` 这一臂里没有 `requirePrincipal` 项**(`task-cwd.ts`:device 车道上那条路径落在
+ *       **发起者自己的设备**上,归属由 `device_session` 绑定行验过 ⇒ 跨租户面结构性不存在)。
+ *
+ * 两条判据的**交集之外**有一形谁都不管:**多用户部署但运维没开 `REQUIRE_PRINCIPAL`,也没有 org 治理**。
+ * 那台机器上每一条赦免都成立(它自称单用户),而每一道天花板都不成立(它没有 org 分区)。
+ * ⇒ 先把这个判定位铸成**一处**,再让两条腿都读它(clay 裁定③,2026-09-22):**不许各自加特判**——
+ * 每加一条特判,「这台机器算不算托管」在本仓就多一个可以自己漂的答案。
+ *
+ * ## 判据的**唯一**标准:运维**显式点名了一个外部身份签发方**
+ *
+ * 🔴 判据里**必须**有不读 `requirePrincipal` 的臂,否则腿①(S-564)是同义反复
+ * (「`REQUIRE_PRINCIPAL` 没设 ⇒ 要求设 `REQUIRE_PRINCIPAL`」永不触发)。所以词表分两类:
+ *  · `require-principal` —— 运维**已经说了**这是多租户(定义式,零假阳);
+ *  · 另外两条 —— 运维没说,但他**显式点了一个外部签发方的名字**。一台机器一个可信主人的形
+ *    (CC 的信任模型)不需要向任何人验签:签发方存在 ⇒ 身份来自这台机器之外 ⇒ 有别人。
+ *
+ * ## 🔴 「受控于控制面」**不是**托管证据(主会话裁定⑥ 的二选一,本仓选这一侧)
+ *
+ * 初版收过第三条臂 `managed-worker`(`SEMA_REGISTRY_WORKER` 在场 = reconciler 管着这台 worker)。
+ * **实测两个反例后撤回**:
+ *  · `src/run-local.ts` 强设 `REQUIRE_PRINCIPAL=false` 之后才 `loadConfig()` —— 一个共享 `.env` 带着
+ *    registry 键就让本机 CLI **拒启**,而拒因指的那根旋钮正是它自己会覆盖回去的(codex 对抗复审同批独立复现);
+ *  · 本仓自己的 `test/config-coverage-blocks.test.ts` 两格(configCenter 块)就是「有 worker 名、没开
+ *    `REQUIRE_PRINCIPAL`」——它们在初版上当场红。
+ * ⇒ **fleet 管理轴 ≠ 租户轴**。同理 `AUTH_BRIDGE_ISSUER` 只收**显式 env**,**绝不**收 boot 期那条
+ * `?? config.configCenter?.baseUrl` 的回退(`boot/stage-09-leader.ts`)—— 那条回退的事实来源同样是
+ * 「配了 center」,收它等于把刚撤回的那条臂换个名字装回来,精度还更差。
+ *
+ * ## 精度优先于召回(逐条写下被排除的候选,不留「我没想到」的空白)
+ *
+ * 假阳 = 一台单用户 turnkey 被拒启 / 被收走一个它一直在用的能力。假阴 = 缺口照旧。
+ * 两者都坏,但假阳会当场打到在跑的部署,所以词表只收**单用户形写不出来**的证据:
+ *  · ❌ `operatorPrincipals` 非空 —— **真假阳**:`IMAGE_BAKES_ENABLED` 那条既有不变量
+ *    (`config-invariants.ts` 的 `bake-operator-principals`)**强制**开烤门的部署把它填非空,
+ *    于是一台开了烤门的单用户机器会被判成托管。
+ *  · ❌ `configCenter`(含 `worker` 名)/ auth-bridge 的 center 回退 —— 见上一段,已实测撤回。
+ *  · ❌ `SERVICE_AUTH_TOKENS` 条目数 —— 一台机器上同时给 cli 与 web-admin 发一只令牌是单用户常态。
+ *  · ❌ `DB_BACKEND=mysql|pg` —— 那是**耐久性**轴,不是租户轴(单用户要 durable run 也得开)。
+ *  · ❌ `BIND_HOST` 非回环 —— 容器里 `0.0.0.0` 是单用户常态(compose/k8s 默认)。
+ *  · ❌ `COMPLIANCE_PROFILE` / `RETENTION_MAX_AGE_DAYS` / `LOCKED_CONFIG_KEYS` —— 数据/治理轴;
+ *    一个自己给自己上合规档的单用户部署不该因此被拒启。
+ *
+ * **已知召回缺口(显式登记,不用「应该很少」填空)**:一台既不验 principal-JWT、也没点 auth-bridge
+ * 签发方的团队机器(例如只靠反代加一层 basic auth)本表**看不见**。它的运维面补偿是:
+ * `REQUIRE_PRINCIPAL=true` 本身就是那台机器该设的键,而 `docs/DEPLOY-PREREQS.md` 的「托管形前置」段
+ * 把判据写成了给人读的清单。
+ */
+import { type ServiceConfigFlat } from "./config-types.js";
+/** 托管/多租的**证据词表**(闭集;加词 ⇒ {@link hostedEvidenceNote} 的穷举 switch 编译红)。 */
+export declare const HOSTED_EVIDENCE_WORDS: readonly ["require-principal", "principal-jwt", "auth-bridge-issuer"];
+/** 一条证据(闭集三词)。 */
+export type HostedEvidence = (typeof HOSTED_EVIDENCE_WORDS)[number];
+/**
+ * 本判据读的配置键集 —— 取自平铺配置型(键名/类型永不与真配置漂)。
+ * `ServiceConfig` 与 `CrossInvariantView` 都**结构上**满足本形,所以 boot 腿、热路径腿与请求腿读同一只函数。
+ */
+export type HostedPostureInput = Readonly<Pick<ServiceConfigFlat, "requirePrincipal" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer">>;
+/** 一台 worker 的托管姿态事实(值 + 证据)——纯数据。 */
+export interface HostedPostureFacts {
+    /** 这台部署是不是托管 / 多租。 */
+    readonly hosted: boolean;
+    /** 判成托管的**全部**证据(按词表顺序;`hosted:false` ⇒ 空数组)。拒因逐字点它们,运维才知道改哪儿。 */
+    readonly evidence: readonly HostedEvidence[];
+}
+/**
+ * 判定位的**唯一**铸点(纯数据 ⇒ `build*`)。
+ *
+ * 🔴 `evidence` 收**全部**命中而不是第一条:拒因要告诉运维「这台机器凭哪几件事被判成托管」,
+ * 只报一条会让他改掉那一条之后再撞一次同样的拒(两次拒启之间他学不到全貌)。
+ */
+export declare function buildHostedPosture(c: HostedPostureInput): HostedPostureFacts;
+/**
+ * 判据里**非定义式**那两条证据背后的 env 名 —— 即「运维显式点名了一个外部身份签发方」的全部拼法。
+ *
+ * 🔴 **单一属主**:`src/run-local.ts` 那条「强制单用户」的腿按本表清 env(W-新8)。它**结构上**兑现不了
+ * 这些键(它把 `REQUIRE_PRINCIPAL` 焊死成 false ⇒ principal 门根本不上场),留着它们只会让判据看见一个
+ * 假事实、然后拿一个**它自己会覆盖回去**的旋钮当拒因。名表抄第二份的那天,加一条证据 = run-local 静默漏清。
+ * ⚠️ 表里**没有** `REQUIRE_PRINCIPAL`(那是定义式那一条,run-local 自己显式写值)也**没有**
+ * `SEMA_REGISTRY_*`(fleet 管理轴,本判据根本不读 —— 本机 CLI 从组织下发面取配置是正当用法)。
+ */
+export declare const HOSTED_EVIDENCE_ENV_KEYS: readonly ["PRINCIPAL_JWT_PUBKEYS", "PRINCIPAL_JWT_ISS", "PRINCIPAL_JWT_AUD", "AUTH_BRIDGE_ISSUER"];
+/**
+ * 把上表那几根 env **清掉**(`run-local.ts` 的「强制单用户」腿调它)。
+ *
+ * 🔴 **为什么是四行字面 `delete` 而不是照表循环**:配置目录的 D1 对账门按文件数**动态 env 读点**并且是
+ * **只降不升的棘轮** —— `process.env[k]` 那种计算属性读它一个都不放过(理由是动态读让「这个文件读了哪些
+ * 键」变成机器看不见的事)。照表循环会给 `run-local.ts` 顶上第 3 处动态读、当场撞棘轮。⇒ 名字写成字面,
+ * **但只写这一处**;上面那张表仍是**声明面**的属主,两者的一致性由
+ * `test/hosted-posture.test.ts` 的行为格看着(逐个设上再调一次,断言全没了)——不是靠人眼比对。
+ *
+ * ⚠️ 表里**没有** `REQUIRE_PRINCIPAL`(定义式那条,调用方自己显式写值)也没有 `SEMA_REGISTRY_*`
+ * (fleet 管理轴,本判据根本不读)。
+ */
+export declare function clearHostedEvidenceEnv(): void;
+/** 一条证据的运维事实句 —— **穷举 switch,无缺省臂**(词表加员即编译红)。 */
+export declare function hostedEvidenceNote(e: HostedEvidence): string;
+/**
+ * **腿①(S-564)** —— 托管形部署必须显式开 `REQUIRE_PRINCIPAL`。返回拒因;`undefined` = 通过。
+ *
+ * 判据与文案的**唯一属主**:boot 期的拒启 throw(`config.ts` 的跨域不变量区)与
+ * `CONFIG_CROSS_INVARIANTS` 表(`config-invariants.ts`)**调同一只**,不各抄一份([ref] 的纪律 +
+ * [ref]「禁手抄投影」)。
+ *
+ * 🔴 **表里那一行今天是「预置纵深」,不是在岗执法**(主会话裁定⑤,撤回初版那句「热路径同样在岗」):
+ * `checkCrossInvariants` 的候选视图(`config-hot` 那条腿)今天只覆写 limits 那 14 员键,本判据读的
+ * 5 个键**一个都不在里面** ⇒ 那一行在热路径上**永不返回拒因**。它先在场是纵深(哪天候选视图覆盖到
+ * auth 域,它自己就活),不是现在有人在执法。**假覆盖比没覆盖更坏**(7.94.0 自己刚立的反面规矩)。
+ *
+ * 🔴 **为什么是拒启而不是 warn**:`principal` 缺席在本仓走 `"default"` 赦免 —— 一台没开这根旋钮的
+ * 多用户机器会把**全服无主会话**列进 `ListAgents`,并且把 hooks / shellEnv / cwd / 根围栏拓宽四条
+ * 能力授予面一并对每个调用方打开(四条面的谓词各不相同,逐条在模块头注 —— 别照「都一样」读)。
+ * 安全轴上的 fail-open 不许有安静的兜底臂([ref])。
+ *
+ * 🔴 **`settings.env` 那一条的射程要说准**(亲读 `plugins/remote-env-host.ts` 的 `mergeEnv`):适配器的
+ * `env` 是**并**到 `process.env` 上的逐键覆盖(不是替),而 `task-settings.ts` 的 `cleanEnvMap` 只判
+ * 类型/键长/值长/条数、**没有任何键名拒集** ⇒ `PATH` / `LD_PRELOAD` / `NODE_OPTIONS` 一视同仁。
+ * 那条面唯一的防线就是上面那道闸;闸一漂,面全开。
+ */
+export declare function hostedPrincipalRefusal(c: HostedPostureInput): string | undefined;
+/** 腿② 读的键集 = 射程判据 + 天花板旋钮。
+ *  🔴 档位的**词表属主在 `config-types.ts`**(`TASK_WRITE_FACE_ESCALATIONS`)—— 本模块刻意**不留第二份**:
+ *  施工期真犯过一次(两处各写一份 `["allow","refuse"]`,加词的那天两边会分家),[ref] 第一排查点。 */
+export type TaskWriteFaceInput = TaskHostPostureScope & Readonly<Pick<ServiceConfigFlat, "taskWriteFaceEscalation">>;
+/** 任务层宿主姿态声明被拒时的 wire 子码(附录 A 的 `request.` 族)。 */
+export declare const HOST_POSTURE_REFUSED_CODE = "request.host_posture_refused";
+/** 射程判据读的键集(托管证据 + 车道)。 */
+export type TaskHostPostureScope = HostedPostureInput & Readonly<Pick<ServiceConfigFlat, "remoteExec">>;
+/**
+ * **腿③(clay 裁定① 2026-09-22)** —— `approverPosture` 在这台部署上兑现吗?`false` ⇒ 调用点
+ * **忽略 + 留声**(与 `task_hooks_ignored` / `task_cwd_ignored` / `task_shell_env_ignored` 同姿势)。
+ *
+ * 🔴 **为什么这一条不拒**(初版给了 422,当批撤回):这个键**零授权** —— 引擎只把它渲给模型,没有任何
+ * 裁决腿读它(`http/wire-types.ts` 的字段注逐字,来源是 core 的 `ApproverPosture` 头注)。而续跑腿
+ * **逐字重放盘上的体**,调用方**删不掉**它 ⇒ 一条 park 会被永久砖死;`resumePlanReview` 上更贵:
+ * nonce 先烧、拒在其后才抛,运维重签再撞同一个拒 = 无限循环。本仓对这一类的成文结论逐字是
+ * 「**砖死 resume 比降级糟**」(`boot/resolve-spec.ts` 顶部那段列了三处先例)。
+ * ⇒ 把本批最硬的处置给族里**危害最小**的成员,方向是错的。
+ *
+ * ⚠️ 它**不是**没有危害:引擎据此把 bypass 指令渲给模型,而那段文字指示模型**改用 Bash 改文件**
+ * 而不是用文件工具 ⇒ 写动作从**文件带**(core 写门 / `sensitiveWritePatterns` / `writeProtectedPaths`)
+ * 挪到**shell 带**(`shellGate`)。所以它要被**忽略**,而不是原样过境;留声让运维看得见。
+ */
+export declare function taskApproverPostureHonored(c: TaskHostPostureScope): boolean;
+/**
+ * **腿②** —— 这条请求要掀开写围栏,这台部署给不给?返回拒因;`undefined` = 放行。
+ *
+ * 🔴 **响亮拒而不是静默钳**:一个明确要求「别拦我」的调用方撞上一道它掀不掉、也看不见的墙,
+ * 正是 [ref] 裁定要修掉的那个失败形。core 在同一条律上的姿势也是抛,不是钳;而本仓这一侧**不能**改用
+ * governance 的 `overrides.writeFace="roots"` 去压——实测 core 的 `tightenTaskSpec` 在
+ * base `open` × override `roots` 上**静默**取 `roots`(该函数零回调形参 ⇒ 没有留痕通道)。
+ *
+ * 🔴 **射程(含 device 车道那条对位臂)在共用谓词 {@link hostPostureDeclarationsHonored} 上** ——
+ * 两条腿同射程、不同处置,射程只有一处答案。
+ */
+export declare function taskWriteFaceRefusal(c: TaskWriteFaceInput): string | undefined;
+//# sourceMappingURL=hosted-posture.d.ts.map

package/dist/hosted-posture.js

@@ -0,0 +1,76 @@
+import { TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
+import { deviceCwdHonored } from "./task-cwd.js";
+export const HOSTED_EVIDENCE_WORDS = ["require-principal", "principal-jwt", "auth-bridge-issuer"];
+export function buildHostedPosture(c) {
+    const evidence = [];
+    if (c.requirePrincipal === true)
+        evidence.push("require-principal");
+    if (c.principalJwtPubkeys.length > 0 || c.principalJwtIss !== undefined || c.principalJwtAud !== undefined)
+        evidence.push("principal-jwt");
+    if (c.authBridgeIssuer !== undefined)
+        evidence.push("auth-bridge-issuer");
+    return { hosted: evidence.length > 0, evidence };
+}
+export const HOSTED_EVIDENCE_ENV_KEYS = ["PRINCIPAL_JWT_PUBKEYS", "PRINCIPAL_JWT_ISS", "PRINCIPAL_JWT_AUD", "AUTH_BRIDGE_ISSUER"];
+export function clearHostedEvidenceEnv() {
+    delete process.env.PRINCIPAL_JWT_PUBKEYS;
+    delete process.env.PRINCIPAL_JWT_ISS;
+    delete process.env.PRINCIPAL_JWT_AUD;
+    delete process.env.AUTH_BRIDGE_ISSUER;
+}
+export function hostedEvidenceNote(e) {
+    switch (e) {
+        case "require-principal":
+            return "REQUIRE_PRINCIPAL=true (this deployment declares itself multi-tenant)";
+        case "principal-jwt":
+            return "PRINCIPAL_JWT_PUBKEYS/ISS/AUD is configured (principal identities are verified against an external issuer — a single-user turnkey box has no issuer)";
+        case "auth-bridge-issuer":
+            return "AUTH_BRIDGE_ISSUER is set explicitly (a second external SSO-JWT issuer; the registry-URL fallback is deliberately NOT read here — that fact is fleet management, not tenancy)";
+    }
+}
+function hostedBecause(facts) {
+    return facts.evidence.map(hostedEvidenceNote).join("; ");
+}
+export function hostedPrincipalRefusal(c) {
+    const facts = buildHostedPosture(c);
+    if (!facts.hosted || c.requirePrincipal === true)
+        return undefined;
+    return (`this deployment looks HOSTED/multi-tenant (${hostedBecause(facts)}) but REQUIRE_PRINCIPAL is not set — ` +
+        `an absent principal takes the single-user "default" amnesty, which would list every ownerless session to every caller ` +
+        `and open the single-user capability grants (settings.hooks / settings.env / cwd / additionalDirectories) to all of them. ` +
+        `Set REQUIRE_PRINCIPAL=true (and OPERATOR_PRINCIPALS for the operator-only routes), or remove the hosted-deployment configuration if this really is a single-user box.`);
+}
+export const HOST_POSTURE_REFUSED_CODE = "request.host_posture_refused";
+function hostPostureDeclarationsHonored(c) {
+    if (deviceCwdHonored(c))
+        return true;
+    return !buildHostedPosture(c).hosted;
+}
+export function taskApproverPostureHonored(c) {
+    return hostPostureDeclarationsHonored(c);
+}
+export function taskWriteFaceRefusal(c) {
+    switch (c.taskWriteFaceEscalation) {
+        case "allow":
+            return undefined;
+        case "refuse":
+            return (`permissionMode:"bypassPermissions" opens the WRITE containment face (TaskSpec.writeFace:"open") — the run could write outside the task root. ` +
+                `Refused because this deployment pins TASK_WRITE_FACE_ESCALATION=refuse (the operator's own declaration — it wins over any request, unconditionally). ` +
+                `Omit permissionMode:"bypassPermissions", or ask the operator for TASK_WRITE_FACE_ESCALATION=allow.`);
+        case undefined:
+            break;
+        default: {
+            const unhandled = c.taskWriteFaceEscalation;
+            return (`permissionMode:"bypassPermissions" opens the WRITE containment face (TaskSpec.writeFace:"open") — the run could write outside the task root. ` +
+                `Refused because this deployment carries an UNRECOGNISED TASK_WRITE_FACE_ESCALATION word (${String(unhandled)}) — a knob this build cannot interpret is never read as permission. ` +
+                `Set TASK_WRITE_FACE_ESCALATION to one of ${TASK_WRITE_FACE_ESCALATIONS.join(" | ")}, or unset it to let the deployment posture decide.`);
+        }
+    }
+    if (hostPostureDeclarationsHonored(c))
+        return undefined;
+    const facts = buildHostedPosture(c);
+    return (`permissionMode:"bypassPermissions" opens the WRITE containment face (TaskSpec.writeFace:"open") — the run could write outside the task root. ` +
+        `Refused because this deployment is HOSTED/multi-tenant (${hostedBecause(facts)}), so the task layer may only TIGHTEN the write face, never open it. ` +
+        `Set TASK_WRITE_FACE_ESCALATION=allow if the DEPLOYMENT permits the task layer to open it, or omit permissionMode:"bypassPermissions".`);
+}
+//# sourceMappingURL=hosted-posture.js.map

package/dist/http/resume-ctx-read.d.ts

@@ -0,0 +1,40 @@
+/**
+ * **续跑上下文这一次读的结局**(S-577 第二半,7.94.0)—— 属主模块,所有消费腿共用这一只读口。
+ *
+ * 🔴 **为什么必须有这只铸点**:此前各消费腿各写一句 `.catch(() => null)`(还有一处把异常文案拼上 wire),
+ * 于是店层在 S-577 里把坏体从「答缺席」改成「响亮拒」之后,那些 `catch` 会把那次拒**原样吞回缺席** ——
+ * 机制上「坏体不再与缺席同答」成立,**用户面上不成立**(用户拿到的还是同一个 409)。判据要钉用户实际
+ * 拿到的码,这只铸点就是让那句判据有地方落(test [ref] 的判据订正,当拍采纳)。
+ *
+ * 三态与各自的理由:
+ *  · `ok` —— 读出来了。
+ *  · `absent` —— 行不在(`reapCtx` 按设计在 run 终态后删掉它),**或**读腿抛了一个**不是坏体**的错
+ *    (连接 / 超时 / 权限 / 店抖动):证不出它在就当它不在,**这是刻意保守**([ref] 方向锚:
+ *    拒绝可重试,搁浅不可)。
+ *  · `corrupt` —— 读腿抛了**坏体类**错(属主谓词 `isJsonColumnBodyProblem`:`not-json` / `malformed`)。
+ *    **不折成缺席**:两者的运维动作完全不同(前者去查那一行,后者什么都不用做)。
+ *    ⚠️ `not-text`(投影漂 = 我方的码病)**刻意不进这一态**,原样上抛、响亮成 500 —— 不许伪装成
+ *    「数据坏了」,更不许折成缺席(那会让一次代码漂看起来像「这条会话没有上下文」)。
+ */
+import type { CheckpointCtx } from "./route-ctx.js";
+export type ResumeCtxRead = {
+    readonly kind: "ok";
+    readonly ctx: CheckpointCtx;
+} | {
+    readonly kind: "absent";
+} | {
+    readonly kind: "corrupt";
+    readonly where: string;
+};
+export declare function readResumeCtx(load: Promise<CheckpointCtx | null>): Promise<ResumeCtxRead>;
+/** 坏体的对外答复 —— 与会话策略面**同码**(`session-policy-wire.ts` 的 `corrupt` ⇒ 500),不铸新词。
+ *  文案只说「哪一行读不出来 + 该找谁」,不把店层 detail 拼上 wire(内部机件不上 wire,S-376 同律)。 */
+export declare function resumeCtxCorruptAnswer(where: string): {
+    status: number;
+    body: {
+        error: string;
+        errorCode: string;
+        where: string;
+    };
+};
+//# sourceMappingURL=resume-ctx-read.d.ts.map

package/dist/http/resume-ctx-read.js

@@ -0,0 +1,25 @@
+import { isJsonColumnBodyProblem, SqlJsonColumnError } from "../plugins/sql-json-column.js";
+export async function readResumeCtx(load) {
+    try {
+        const ctx = await load;
+        return ctx == null ? { kind: "absent" } : { kind: "ok", ctx };
+    }
+    catch (e) {
+        if (isJsonColumnBodyProblem(e))
+            return { kind: "corrupt", where: e.where };
+        if (e instanceof SqlJsonColumnError)
+            throw e;
+        return { kind: "absent" };
+    }
+}
+export function resumeCtxCorruptAnswer(where) {
+    return {
+        status: 500,
+        body: {
+            error: "the stored resume context for this session cannot be read — nothing was decided and nothing was resumed. Ask whoever operates this deployment to look at the row named in `where`: it has to be repaired or removed before this session can resume.",
+            errorCode: "corrupt",
+            where,
+        },
+    };
+}
+//# sourceMappingURL=resume-ctx-read.js.map

package/dist/http/resume-legs.js

@@ -35,6 +35,7 @@ import { gatedPrincipal, explicitOperatorOk } from "./principal-gate.js";
 import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflict.js";
 import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
+import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
 function isCheckpointReopenedFailure(r) {
     const code = failureCodeOf(r.terminal);
     return code === "resume.env_failed" || code === "resume.tool_unavailable" || code === "resume.tool_contract_mismatch";
@@ -278,30 +279,17 @@ export function createResumeLegs(ctx) {
                     : await startFreshHostTurn(plan.hostSessionId, plan.message, admittedPayer, req, parkedResume, plan.runId);
             }
         }
-        let ctx;
-        try {
-            ctx = await ctxPromise;
-        }
-        catch (e) {
-            return { status: 409, body: { error: `resume context load failed: ${e instanceof Error ? e.message : String(e)}`, errorCode: "conflict.resume_context_unavailable" } };
-        }
+        const ctxRead0 = await readResumeCtx(ctxPromise);
+        if (ctxRead0.kind === "corrupt")
+            return resumeCtxCorruptAnswer(ctxRead0.where);
+        const ctx = ctxRead0.kind === "ok" ? ctxRead0.ctx : null;
         if (!ctx)
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        let spec;
-        let engineNotices = [];
-        try {
-            ({ spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth));
-        }
-        catch (e) {
-            if (e instanceof HttpError) {
-                return {
-                    status: 409,
-                    body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) },
-                };
-            }
-            throw e;
-        }
+        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        if (!resolved.ok)
+            return resolved.answer;
+        const { spec, engineNotices } = resolved;
         const pendingTool = cp.pendingAction.toolName;
         if (decision === "approve" && pendingTool === ASK_USER_QUESTION_TOOL_NAME && !answer) {
             return { status: 400, body: { error: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })", errorCode: "request.field_conflict" } };
@@ -335,6 +323,24 @@ export function createResumeLegs(ctx) {
         const spec = await deps.resolveSpec({ ...body, ...ONE_SHOT_HISTORY_STRIP }, req, auth, { leg: "resume", onNotice: (n) => engineNotices.push(n) });
         return { spec, engineNotices };
     };
+    const resolveResumeSpecOrBlocked = async (body, req, auth) => {
+        try {
+            const { spec, engineNotices } = await resolveResumeSpec(body, req, auth);
+            return { ok: true, spec, engineNotices };
+        }
+        catch (e) {
+            if (e instanceof HttpError) {
+                return {
+                    ok: false,
+                    answer: {
+                        status: 409,
+                        body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) },
+                    },
+                };
+            }
+            throw e;
+        }
+    };
     async function driveResumeIntoRunLog(args) {
         if (args.acceptEarly !== true)
             return await driveResumeLeg(args);
@@ -1036,11 +1042,17 @@ export function createResumeLegs(ctx) {
         if (gateKind !== RESUMABLE_GATE_KIND) {
             return { status: 409, body: { error: `task is suspended on a '${gateKind ?? "unknown"}' gate, not a resumable resource/preempt suspension — an approval gate must be decided via POST /v1/approvals/:id/decide`, errorCode: "gate_not_resumable" } };
         }
-        const ctx = await cs.getCtx(sessionId).catch(() => null);
-        if (!ctx)
+        const ctxRead = await readResumeCtx(cs.getCtx(sessionId));
+        if (ctxRead.kind === "corrupt")
+            return resumeCtxCorruptAnswer(ctxRead.where);
+        if (ctxRead.kind === "absent")
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
+        const ctx = ctxRead.ctx;
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const { spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        if (!resolved.ok)
+            return resolved.answer;
+        const { spec, engineNotices } = resolved;
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         const verifyRounds = verifyRoundsFromBody(ctx.body);
         return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
@@ -1050,7 +1062,10 @@ export function createResumeLegs(ctx) {
         if (!deps.runStore) {
             return { status: 501, body: { error: "delivering this decision requires a durable run store (DB_BACKEND=mysql|pg|local)", errorCode: "capability.run_store_required" } };
         }
-        const ctx = await cs.getCtx(sessionId).catch(() => null);
+        const ctxRead = await readResumeCtx(cs.getCtx(sessionId));
+        if (ctxRead.kind === "corrupt")
+            return resumeCtxCorruptAnswer(ctxRead.where);
+        const ctx = ctxRead.kind === "ok" ? ctxRead.ctx : null;
         if (!ctx) {
             return {
                 status: 409,
@@ -1066,17 +1081,10 @@ export function createResumeLegs(ctx) {
         if (windowDenial)
             return { status: windowDenial.status, body: windowDenial.body };
         const auth = { sessionId, principal, memoryScope: ctx.memoryScope };
-        let spec;
-        let engineNotices = [];
-        try {
-            ({ spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth));
-        }
-        catch (e) {
-            if (e instanceof HttpError) {
-                return { status: 409, body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) } };
-            }
-            throw e;
-        }
+        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        if (!resolved.ok)
+            return resolved.answer;
+        const { spec, engineNotices } = resolved;
         const hostSpec = { ...spec, objective, sessionId };
         const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
             prepared: { spec: hostSpec, runner: runnerFor(hostSpec), auth, body: ctx.body, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
@@ -1140,11 +1148,17 @@ export function createResumeLegs(ctx) {
                 throw e;
             }
         }
-        const ctx = await cs.getCtx(sessionId).catch(() => null);
-        if (!ctx)
+        const ctxRead = await readResumeCtx(cs.getCtx(sessionId));
+        if (ctxRead.kind === "corrupt")
+            return resumeCtxCorruptAnswer(ctxRead.where);
+        if (ctxRead.kind === "absent")
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
+        const ctx = ctxRead.ctx;
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const { spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        if (!resolved.ok)
+            return resolved.answer;
+        const { spec, engineNotices } = resolved;
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         return driveResumeIntoRunLog({
             runner: runnerFor(spec),
@@ -1222,9 +1236,12 @@ export function createResumeLegs(ctx) {
                 },
             };
         }
-        const ctx = await cs.getCtx(sessionId).catch(() => null);
-        if (!ctx)
+        const ctxRead = await readResumeCtx(cs.getCtx(sessionId));
+        if (ctxRead.kind === "corrupt")
+            return resumeCtxCorruptAnswer(ctxRead.where);
+        if (ctxRead.kind === "absent")
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
+        const ctx = ctxRead.ctx;
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
         const effMode = storedBodyPermissionMode(ctx.body);
         if (permissionModeAfter !== undefined && effMode !== "plan") {
@@ -1232,7 +1249,10 @@ export function createResumeLegs(ctx) {
         }
         const approvedMode = decision === "approve" && effMode === "plan" ? (permissionModeAfter ?? "default") : undefined;
         const resumeBody = approvedMode === undefined ? ctx.body : { ...ctx.body, permissionMode: approvedMode };
-        const { spec, engineNotices } = await resolveResumeSpec(resumeBody, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(resumeBody, req, auth);
+        if (!resolved.ok)
+            return resolved.answer;
+        const { spec, engineNotices } = resolved;
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         const verifyRounds = verifyRoundsFromBody(ctx.body);
         const outcome = {

package/dist/http/routes/capabilities.js

@@ -3,6 +3,7 @@ import { isModelAllowlisted } from "../../model-select.js";
 import { resolveModelApiKey } from "../../key-resolver.js";
 import { isSealedKeyPoison } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
+import { taskApproverPostureHonored, taskWriteFaceRefusal } from "../../hosted-posture.js";
 import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protocol.js";
 import { a2aInjectionHonored } from "../../task-a2a.js";
 import { mcpInjectionHonored } from "../../task-mcp.js";
@@ -135,6 +136,8 @@ export async function handleCapabilities(req, res, match, ctx) {
                 interactiveTools: true,
                 projectContext: cwdHonored(deps.config),
                 callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
+                taskWriteFaceOpen: taskWriteFaceRefusal(deps.config) === undefined,
+                taskApproverPosture: taskApproverPostureHonored(deps.config),
                 executionLane: projectExecutionLaneCapability(deps.config),
                 mcpInjection: mcpInjectionHonored(deps.config),
                 a2a: true,

package/dist/http/routes/images.js

@@ -331,6 +331,18 @@ export async function handleImages(req, res, match, ctx) {
                 sendError(res, 400, "request.field_invalid", "profile, repo, digest are required");
                 return;
             }
+            if (b.bands !== undefined && b.bands !== null && !Array.isArray(b.bands)) {
+                sendError(res, 400, "request.field_invalid", `bands must be an array when present`);
+                return;
+            }
+            const badObjectMeta = ["toolchainVersions", "capabilities", "podContract"].find((k) => {
+                const v = b[k];
+                return v !== undefined && v !== null && (typeof v !== "object" || Array.isArray(v));
+            });
+            if (badObjectMeta !== undefined) {
+                sendError(res, 400, "request.field_invalid", `${badObjectMeta} must be an object when present`);
+                return;
+            }
             const id = await idx.registerBuilding({
                 profile: b.profile,
                 bands: Array.isArray(b.bands) ? b.bands : [],

package/dist/http/routes/runs.js

@@ -29,6 +29,7 @@ import { assertNever } from "../route-ctx.js";
 import { mintAndDriveDurableRun } from "../durable-run-leg.js";
 import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
 import { withPrincipal } from "../../observability/principal-context.js";
+import { readResumeCtx } from "../resume-ctx-read.js";
 const ASK_PARKING_RETRY_AFTER_SEC = 2;
 const ASK_ACTOR_LABEL_MAX = 256;
 const AskDecisionActorSchema = ActorAssertionWire.strip();
@@ -588,8 +589,12 @@ export async function handleRuns(req, res, match, ctx) {
                 const leafId = await Promise.resolve(deps.sessionStorage.getLeafId(run.sessionId)).catch(() => undefined);
                 if (leafId === undefined || leafId === null)
                     return;
-                const resumeCtx = await Promise.resolve(cs.getCtx(run.sessionId)).catch(() => null);
-                if (resumeCtx === null || resumeCtx === undefined) {
+                const resumeRead = await readResumeCtx(Promise.resolve(cs.getCtx(run.sessionId)));
+                if (resumeRead.kind === "corrupt") {
+                    mintResult.corruptCtxWhere = resumeRead.where;
+                    return;
+                }
+                if (resumeRead.kind === "absent") {
                     mintResult.noResumeCtx = true;
                     return;
                 }
@@ -607,8 +612,13 @@ export async function handleRuns(req, res, match, ctx) {
                     createdAt: Date.now(),
                     sourceTaskId: taskId,
                 });
-                const ctxStillThere = await Promise.resolve(cs.getCtx(run.sessionId)).catch(() => null);
-                if (ctxStillThere === null || ctxStillThere === undefined) {
+                const stillRead = await readResumeCtx(Promise.resolve(cs.getCtx(run.sessionId)));
+                if (stillRead.kind === "corrupt") {
+                    await cs.expire(wakeToken, cpScope).catch(() => undefined);
+                    mintResult.corruptCtxWhere = stillRead.where;
+                    return;
+                }
+                if (stillRead.kind !== "ok") {
                     await cs.expire(wakeToken, cpScope).catch(() => undefined);
                     mintResult.noResumeCtx = true;
                     return;
@@ -638,6 +648,10 @@ export async function handleRuns(req, res, match, ctx) {
                 sendDuplicateKey();
                 return;
             }
+            if (mintResult.corruptCtxWhere !== undefined) {
+                sendError(res, 500, "corrupt", "run already ended and this session's stored resume context cannot be read — no wake card was minted and nothing was queued. Ask whoever operates this deployment to repair or remove the row named in `where` before steering this session again.", { where: mintResult.corruptCtxWhere });
+                return;
+            }
             if (mintResult.noResumeCtx) {
                 sendError(res, 409, "conflict.resume_context_unavailable", "run already ended and this session's resume context is gone — a steer queued now could never be delivered by POST /v1/sessions/:id/wake; submit a new task instead");
                 return;

package/dist/http/routes/workflows.js

@@ -2,7 +2,8 @@ import { persistedPlaneOf } from "../../terminal.js";
 import { z } from "zod";
 import { getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus, callKeyOrdinal } from "@sema-agent/core";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
-import { journalEntryOfRow, journalEntryPayload, journalRowPayloadOf } from "../../orchestration/workflow-journal-entry.js";
+import { journalEntryOfBody, journalEntryPayload, journalRowPayloadOf, readJournalRowBody } from "../../orchestration/workflow-journal-entry.js";
+import { decodeJsonColumn } from "../../plugins/sql-json-column.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { createHash } from "node:crypto";
 import { redactErrorMessage, redactHead } from "../../observability/run-terminal.js";
@@ -108,7 +109,7 @@ export async function handleWorkflows(req, res, match, ctx) {
                         return oversizeStub(row.callKey, row.resultBytes);
                     }
                     try {
-                        const { payload, parked } = journalEntryPayload(journalEntryOfRow(row.callKey, row.resultJson));
+                        const { payload, parked } = journalEntryPayload(journalEntryOfBody(row.callKey, decodeJsonColumn(row.resultJson, readJournalRowBody, `workflow_journal.result for entry ${row.callKey}`)));
                         return projectEntry(row.callKey, payload, parked);
                     }
                     catch {

package/dist/http/wire-types.d.ts

@@ -326,10 +326,19 @@ export interface TaskRequestBody {
      * (且只能收紧、deny-wins),前者只说「谁来答卡」。两者在语义上同族,声明它而不开 `bypassPermissions`
      * 只是对模型说了一句与实际不符的话 —— 见契约文档那一段的「谁受伤」。
      *
-     * 🔴 **本仓零判据、原样过境**(`boot/resolve-spec.ts` 写点):词的拒绝逻辑属引擎
-     * (`refuseInvalidApproverPosture` 响亮拒一个不认识的词),server **不加第二道门** —— 在下游再判一次就是
-     * 同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加第二个词就会被静默 400 掉。
-     * 型也从 core 的 `ApproverPosture` 派生(不抄字面联合)。
+     * 🔴 **值域上本仓零判据**(`boot/resolve-spec.ts` 写点):词的拒绝逻辑属引擎
+     * (`refuseInvalidApproverPosture` 响亮拒一个不认识的词),server **不抄词表、不加第二道值域门** ——
+     * 在下游再判一次就是同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加
+     * 第二个词就会被静默 400 掉。型也从 core 的 `ApproverPosture` 派生(不抄字面联合)。
+     *
+     * 🔴 **但「原样过境」自 7.95.0(S-591 腿③)起不再成立 —— 它有一道**准入**闸**:本键是一句**宿主姿态
+     * 声明**(「这个 run 的审批卡由宿主自己自动答」),而在**托管 / 多租**部署上提交方**不是**宿主。
+     * 所以托管形上它被**忽略 + 留声**(`task_approver_posture_ignored`,`honored:false`),与同族的
+     * `settings.hooks` / `cwd` / `settings.env` 三条逐字同姿势;单用户 turnkey 与 device 车道照旧过境
+     * (射程判据单点 = `src/hosted-posture.ts` 的 `taskApproverPostureHonored`)。
+     * ⚠️ **刻意不是 400/422**:本键零授权,而续跑腿逐字重放盘上的体、调用方删不掉它 ⇒ 拒会把一条 parked
+     * 任务永久砖死(clay 裁定① 2026-09-22;本仓成文结论「砖死 resume 比降级糟」)。
+     * ⇒ 这一条与「值域零判据」**不矛盾**:值域仍归引擎,本仓判的是**这台部署认不认这句声明**。
      */
     approverPosture?: ApproverPosture;
     /** MF-30 memory PAUSE (shell-host contract, option B per-request — clay 2026-06-27): `false` makes THIS run