@sema-agent/server 7.96.0 → 7.97.0

package/dist/http/resume-legs.js

@@ -64,6 +64,9 @@ function checkpointRowRedeemableElsewhere(reason) {
     return reason !== undefined && WORKER_SWAP_REDEEMABLE[reason] === true;
 }
 const NON_BINDING_INVALID_OUTCOME_FIELDS = new Set(["hostDecision", "approver"]);
+function notResumableAnswer() {
+    return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
+}
 export function createResumeLegs(ctx) {
     const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
     const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
@@ -458,7 +461,7 @@ export function createResumeLegs(ctx) {
         if (taskId && deps.runStore) {
             claimedRow = freshRunClaimed ? true : await deps.runStore.markResuming(taskId, deps.instanceId ?? "default");
             if (!claimedRow)
-                return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
+                return notResumableAnswer();
             markChildrenStoppedByUserOnAbort(cancelCtrl.signal, taskId, principal);
             fleetPub?.onStart();
             const rs = deps.runStore;
@@ -1179,8 +1182,9 @@ export function createResumeLegs(ctx) {
             ...(ownerLeaseAdmittedFor !== undefined && auth.principal === ownerLeaseAdmittedFor ? { ownerLeaseAdmitted: true } : {}),
         });
     }
-    async function resumePlanReview(sessionId, decision, editedPlan, reason, req, log, acceptEarly, decider, permissionModeAfter) {
+    async function preparePlanReview(sessionId, log, decider) {
         const cs = deps.checkpointStore;
+        const refuse = (answer) => ({ ok: false, answer });
         const log404 = (r) => deps.logger?.info?.("decide_404", {
             reason: r,
             ...(log?.taskId !== undefined ? { taskId: log.taskId } : { sessionId }),
@@ -1192,7 +1196,7 @@ export function createResumeLegs(ctx) {
         const noPending = { status: 404, body: { error: "no pending plan_review for this session (already decided or expired)", errorCode: "not_found.plan_review" } };
         if (!token) {
             log404("no-pending-checkpoint");
-            return noPending;
+            return refuse(noPending);
         }
         if (decider !== undefined && !decider.explicitOperator) {
             const peeked = await cs
@@ -1202,7 +1206,7 @@ export function createResumeLegs(ctx) {
             const peekedOwner = peeked != null ? decodeCheckpointScope(peeked) : undefined;
             if (peekedOwner !== undefined && peekedOwner !== decider.principal) {
                 deps.logger?.warn?.("plan_review_row_scope_mismatch", { sessionId, note: "pending row is foreign to the verified caller — owner gate ahead of the row load" });
-                return noPending;
+                return refuse(noPending);
             }
         }
         let cp;
@@ -1212,40 +1216,45 @@ export function createResumeLegs(ctx) {
         catch (e) {
             if (!(await mayDiscloseRowError(cs, token, decider))) {
                 deps.logger?.warn?.("plan_review_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
-                return noPending;
+                return refuse(noPending);
             }
-            return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
+            return refuse({ status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } });
         }
         if (!cp) {
             log404("checkpoint-missing");
             if (!(await mayDiscloseRowError(cs, token, decider)))
-                return noPending;
-            return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
+                return refuse(noPending);
+            return refuse({ status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } });
         }
         if (decider !== undefined && !decider.explicitOperator && cp.scope !== CHECKPOINT_PUBLIC_SCOPE && cp.scope !== decider.principal) {
             deps.logger?.warn?.("plan_review_row_scope_mismatch", { sessionId, note: "loaded pending row is foreign to the verified caller — TOCTOU fold" });
-            return noPending;
+            return refuse(noPending);
         }
         const gateKind = cp.gate?.kind;
         if (gateKind !== PLAN_REVIEW_GATE_KIND) {
-            return {
+            return refuse({
                 status: 409,
                 body: {
                     error: `task is suspended on a '${gateKind ?? "unknown"}' gate, not a plan_review — a tool approval must be decided via POST /v1/approvals/:id/decide`,
                     errorCode: "gate_not_plan_review",
                 },
-            };
+            });
         }
         const ctxRead = await readResumeCtx(cs.getCtx(sessionId));
         if (ctxRead.kind === "corrupt")
-            return resumeCtxCorruptAnswer(ctxRead.where);
+            return refuse(resumeCtxCorruptAnswer(ctxRead.where));
         if (ctxRead.kind === "absent")
-            return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
-        const ctx = ctxRead.ctx;
+            return refuse({ status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } });
+        return { ok: true, prepared: { sessionId, token, cp, ctx: ctxRead.ctx } };
+    }
+    async function drivePlanReview(prepared, decision, editedPlan, reason, req, acceptEarly, permissionModeAfter) {
+        const { sessionId, token, cp, ctx } = prepared;
+        if ((await deps.checkpointStore.findPendingTokenBySession(sessionId, undefined, { gateKinds: ["plan_review"] })) !== token)
+            return notResumableAnswer();
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
         const effMode = storedBodyPermissionMode(ctx.body);
         if (permissionModeAfter !== undefined && effMode !== "plan") {
-            throw new Error("resumePlanReview: permissionModeAfter was passed for a task that was not submitted with permissionMode \"plan\" — the caller must refuse this before any state changes (see the plan_review route's pre-nonce gate)");
+            throw new Error("drivePlanReview: permissionModeAfter was passed for a task that was not submitted with permissionMode \"plan\" — the caller must refuse this before any state changes (see the plan_review route's pre-nonce gate)");
         }
         const approvedMode = decision === "approve" && effMode === "plan" ? (permissionModeAfter ?? "default") : undefined;
         const resumeBody = approvedMode === undefined ? ctx.body : { ...ctx.body, permissionMode: approvedMode };
@@ -1269,8 +1278,8 @@ export function createResumeLegs(ctx) {
         registry: { idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters },
         helpers: { readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk },
         local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal(), capabilities: createCapabilitiesLocal() },
-        legs: { prepareSpec, finalizeTaskResult, resumeCheckpoint, driveResumeIntoRunLog, resumePreempted, resumeWake, resumePlanReview },
+        legs: { prepareSpec, finalizeTaskResult, resumeCheckpoint, driveResumeIntoRunLog, resumePreempted, resumeWake, preparePlanReview, drivePlanReview },
     };
-    return { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake, resumePlanReview };
+    return { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake, preparePlanReview, drivePlanReview };
 }
 //# sourceMappingURL=resume-legs.js.map

package/dist/http/route-ctx.d.ts

@@ -16,7 +16,7 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { HostDecision } from "../host-decision.js";
-import type { TaskStream, TaskSpec, TaskResult, QuestionAnswer, CheckpointToken, ResumeOutcome, RunInternals, Runner, EngineNotice } from "@sema-agent/core";
+import type { TaskStream, TaskSpec, TaskResult, QuestionAnswer, Checkpoint, CheckpointToken, ResumeOutcome, RunInternals, Runner, EngineNotice } from "@sema-agent/core";
 import type { FlatServiceDeps, RequestAuth } from "./server.js";
 import type { TaskRequestBody, DecideBinding } from "./wire-types.js";
 import type { IdempotencyCache, SubmitOutcome } from "./idempotency.js";
@@ -154,7 +154,7 @@ export interface DriveResumeArgs {
     /**
      * 🔴 **S-433 合并复审 F2 [high] —— 「本次续跑真正用的那个体」,由本腿在赢下 CAS 之后写回耐久层**
      * (验真后修;必填 —— `driveResumeIntoRunLog` 今天恰有**四个**调用点:legacy `/decide`(`resumeCheckpoint`)、
-     * `resumePreempted`、`resumeWake`、`resumePlanReview`,四条一视同仁)。
+     * `resumePreempted`、`resumeWake`、`drivePlanReview`(S-609 前名 `resumePlanReview`),四条一视同仁)。
      *
      * 病(修前):`resumePlanReview` 在 `driveResumeIntoRunLog` **受理(2xx)之后**才 `putCtx(sessionId,
      * {...ctx, body})`,而 `ctx` 是请求**开头** `getCtx` 读到的那一份,两个店的 `putCtx` 又都是按
@@ -177,7 +177,7 @@ export interface DriveResumeArgs {
      * 🔴 写失败**响亮但不致命**(codex r1 两条 [high] 验真后定):core 的 `resumeStream` 是 **EAGER** 的 ——
      * 写点这一拍 run 已经在执行,裸抛会把一条活腿判成 failed + 释放 claim 而执行还在继续。⇒ 一个臂、
      * 四条腿同守:计数 `resume_ctx_not_persisted_total` + 一行 warn,本次续跑照常。方向论证(不是 [ref] 的
-     * 静默放宽):写失败 ⇒ 耐久体保持**上一次**的值,而这四条腿里只有 `resumePlanReview` 改写这个体、
+     * 静默放宽):写失败 ⇒ 耐久体保持**上一次**的值,而这四条腿里只有 `drivePlanReview` 改写这个体、
      * 且只会**放宽** ⇒ 落盘的恒不比本次续跑更宽。旧的 `plan_approve_mode_not_persisted`(plan 专用)随本批删除,
      * 由上面这只家族级的取代。全文见 `resume-legs.ts` 的 `commitResumeCtx` 顶注。
      */
@@ -311,6 +311,17 @@ export interface DriveResumeArgs {
      */
     ownerLeaseAdmitted?: boolean;
 }
+/**
+ * S-609(7.97.0):plan_review 纯读段全部过关后交给驱动段的那一份 —— **选中的那张卡**(token + 载入的行)与**它那一刻**
+ * 的续跑上下文。三者一起走:驱动段只认这张卡,ctx 读绑在它上面(读在选卡之后;之后任何 ctx 写都得先赢这张卡的
+ * CAS,于是一份过期的读只会让驱动段在 CAS 上败,不会被配给别的卡)。
+ */
+export interface PreparedPlanReview {
+    readonly sessionId: string;
+    readonly token: CheckpointToken;
+    readonly cp: Checkpoint;
+    readonly ctx: CheckpointCtx;
+}
 /** 提交/续跑「腿」= 跨域共享的**有状态**长流程(不像 {@link RouteHelpers} 那样只依赖 deps/config:它们要写
  *  run log、发 fleet 帧、走 markResuming CAS、驱动模型)。A9 上批的停点就在这里——tasks/runs 两域共用
  *  `prepareSpec`,approvals/assistant/notify-wake 三域共用 resume 家族,把它们跟着任一域搬都会造出
@@ -395,21 +406,36 @@ export interface RouteLegs {
         status: number;
         body: object;
     }>;
-    /** assistant plan_review 三态腿。 */
-    resumePlanReview(sessionId: string, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, req: IncomingMessage | undefined, 
+    /**
+     * assistant plan_review 三态腿的**纯读段**(S-609,7.97.0):选卡 → 属主轻读 → 载入 → 行级 scope → 门类 → 这条决断
+     * 唯一的一次 ctx 读。任何一步拒 ⇒ `{ok:false, answer}`(不改任何状态;端点在消费一次性 nonce **之前**把它答出去);
+     * 全部过关 ⇒ `{ok:true, prepared}`,交给 {@link RouteLegs.drivePlanReview}。语义属主 = `resume-legs.ts` 同名函数顶注。
+     */
+    preparePlanReview(sessionId: string, 
     /** [ref]/[ref] 件5:`decide_404` 判别日志的附加位(只进日志,不上 wire;身份只记有无不记值)。 */
     log?: {
         taskId?: string;
         principalPresent?: boolean;
     }, 
-    /** [ref] 件 S-1:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/plan_review` 腿传 `true`。 */
-    acceptEarly?: boolean, 
-    /** [ref]②([ref]):调用方已验身份的裁定(直连门 = HMAC 验出的 principal)—— 腿内行级属主复核
+    /** [ref]②([ref]):调用方已验身份的裁定(直连门 = HMAC 验出的 principal)—— 属主轻读与行级属主复核
      *  ([ref] R3 同形;缺席 = 匿名 dev 部署,不咬)。 */
     decider?: {
         principal?: string;
         explicitOperator: boolean;
-    }, 
+    }): Promise<{
+        readonly ok: false;
+        readonly answer: {
+            status: number;
+            body: object;
+        };
+    } | {
+        readonly ok: true;
+        readonly prepared: PreparedPlanReview;
+    }>;
+    /** plan_review 三态腿的**驱动段**(S-609):只吃 prepare 的结果,用它选定的 token,不再选卡、不再读 ctx。 */
+    drivePlanReview(prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, req: IncomingMessage | undefined, 
+    /** [ref] 件 S-1:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/plan_review` 腿传 `true`。 */
+    acceptEarly?: boolean, 
     /** S-433:批准之后这条会话继续用的 permission mode(闭集 `PLAN_APPROVE_PERMISSION_MODES_AFTER`;只在 `approve`
      *  上有意义,缺席 ⇒ `"default"`)。语义与判据的唯一属主 = `resume-legs.ts` 的同名形参顶注。 */
     permissionModeAfter?: PlanApprovePermissionModeAfter): Promise<{

package/dist/http/routes/approvals-assistant.d.ts

@@ -36,7 +36,7 @@ export declare function planReviewBodyKeyIssue(raw: unknown): KeyClosureIssue |
  *  · **签名域**(直连门的 HMAC 信封第五位)—— 属主是**跨仓字节契约**(§6.2 / `approvalHmacMessage`,
  *    签名器在 cli / SDK)。那份契约明写空串与 `null` 是两个不同的被签值。⇒ **逐字线值,永不折叠**;
  *    在这里折一刀,一份合法签发的空理由证明就永远 401(合并复审 R1 [high] 真复现过)。
- *  · **上送域**(`resumePlanReview` / `resumeCheckpoint` 的 `reason` 尾参)—— 属主是**引擎的单铸点**
+ *  · **上送域**(`drivePlanReview` / `resumeCheckpoint` 的 `reason` 尾参)—— 属主是**引擎的单铸点**
  *    (7.19.0 / [ref] 把「人的结算」收进一个铸点,空文本在那里折成缺席,live 与 durable decide 两条路径同形)。
  *    ⇒ **原样透传**;跨仓宪法「源头修复禁下游旁路」:在下游再折一次就是同一语义的第二个写者,
  *    今天两者答案相同,上游哪天改法就变成一条谁都查不出来的分歧。

package/dist/http/routes/approvals-assistant.js

@@ -19,6 +19,8 @@ import { gatedPrincipal, explicitOperatorOk, isOperator, sendPrincipalRefusal }
 import { governanceOriginOf } from "../active-run-conflict.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
+import { readResumeCtx, resumeCtxCorruptAnswer } from "../resume-ctx-read.js";
+import { recordFailOpen } from "../../observability/fail-open.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 const DECIDE_BODY_DECLARED_KEYS = [
     "answer", "boundCallId", "boundInputHash", "checkpointToken", "decision", "reason", "remember", "settledBy", "updatedInput",
@@ -199,7 +201,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
     const { deps } = ctx;
     const { preemptableRuns } = ctx.registry;
     const { readJson, rateLimited, quotaExceeded, safeDecode } = ctx.helpers;
-    const { resumeCheckpoint, resumePreempted, resumePlanReview } = ctx.legs;
+    const { resumeCheckpoint, resumePreempted, preparePlanReview, drivePlanReview } = ctx.legs;
     {
         const cs = deps.checkpointStore;
         const principal = gatedPrincipal(req, deps.config);
@@ -271,7 +273,10 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const scope = operator && ownerParam ? ownerParam : (principal ?? "__none__");
             const summaries = await cs.listByScope(scope);
             const inbox = (await Promise.all(summaries.map(async (s) => {
-                const ctx = await cs.getCtx(s.sessionId).catch(() => null);
+                const ctxRead = await readResumeCtx(cs.getCtx(s.sessionId));
+                if (ctxRead.kind === "corrupt")
+                    recordFailOpen("server.assistant-inbox.objective-ctx-corrupt", ctxRead.where);
+                const objective = ctxRead.kind === "ok" ? (ctxRead.ctx.body?.objective ?? null) : null;
                 const input = s.toolInput != null ? redactedPreview(s.toolInput) : null;
                 return {
                     sessionId: s.sessionId,
@@ -286,7 +291,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(s.denialLimitFallback !== undefined ? { denialLimitFallback: s.denialLimitFallback } : {}),
                     ...(s.origin !== undefined ? { origin: s.origin } : {}),
                     ...(s.ruleStoreUnreadable !== undefined ? { ruleStoreUnreadable: s.ruleStoreUnreadable } : {}),
-                    objective: ctx?.body?.objective ?? null,
+                    objective,
                     input,
                 };
             }))).sort((a, b) => (b.severity ?? 0) - (a.severity ?? 0) || (a.createdAt ?? 0) - (b.createdAt ?? 0));
@@ -520,9 +525,14 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
+            const plan = await preparePlanReview(run.sessionId, { taskId, principalPresent: principal !== undefined }, { principal: deciderPrincipal, explicitOperator });
+            if (!plan.ok) {
+                sendResumeOutcome(res, plan.answer, deps.logger);
+                return;
+            }
             if (body.permissionModeAfter !== undefined) {
-                const storedCtx = await deps.checkpointStore?.getCtx(run.sessionId).catch(() => null);
-                if (storedCtx?.body !== undefined && storedBodyPermissionMode(storedCtx.body) !== "plan") {
+                const storedCtx = plan.prepared.ctx;
+                if (storedCtx.body !== undefined && storedBodyPermissionMode(storedCtx.body) !== "plan") {
                     sendError(res, 400, "request.field_conflict", "permissionModeAfter does not apply to this task: it was not submitted with permissionMode \"plan\", so approving the plan lifts no read-only restriction");
                     return;
                 }
@@ -539,7 +549,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
             }
-            const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, { taskId, principalPresent: principal !== undefined }, true, { principal: deciderPrincipal, explicitOperator }, isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined);
+            const out = await drivePlanReview(plan.prepared, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, true, isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined);
             sendResumeOutcome(res, out, deps.logger);
             return;
         }

package/dist/http/routes/capabilities.js

@@ -12,6 +12,7 @@ import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey
 import { mcpForScenario } from "../../config-center/facade.js";
 import { sendJson, sendError } from "../send.js";
 import { assertNever } from "../route-ctx.js";
+import { fileHistoryCaptureOf } from "../../file-history-capture.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { projectMemoryEngineCapability } from "../../memory-posture.js";
 import { projectWriteProtectionCapability } from "../../write-protection.js";
@@ -173,6 +174,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 rewindFiles: Boolean(deps.fileHistoryStore),
                 restoreFiles: Boolean(deps.fileHistoryStore),
                 rewindFilesTo: Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && deps.sessionStorage?.getLeafId),
+                fileHistoryCapture: fileHistoryCaptureOf(deps.fileHistoryStore),
                 scheduler: Boolean(deps.config.schedulerEnabled && deps.config.requirePrincipal !== true && deps.config.remoteExec?.provider === "host"),
                 sessionSync: Boolean(deps.backend && deps.sessionStorage?.exportEntries && deps.sessionStorage?.beginImportStaging && deps.fileHistoryStore),
                 sendUserFile: Boolean(deps.sendUserFile && deps.config.sendUserFile?.publicEndpoint),

package/dist/http/routes/runs.js

@@ -589,7 +589,7 @@ export async function handleRuns(req, res, match, ctx) {
                 const leafId = await Promise.resolve(deps.sessionStorage.getLeafId(run.sessionId)).catch(() => undefined);
                 if (leafId === undefined || leafId === null)
                     return;
-                const resumeRead = await readResumeCtx(Promise.resolve(cs.getCtx(run.sessionId)));
+                const resumeRead = await readResumeCtx(cs.getCtx(run.sessionId));
                 if (resumeRead.kind === "corrupt") {
                     mintResult.corruptCtxWhere = resumeRead.where;
                     return;
@@ -612,7 +612,7 @@ export async function handleRuns(req, res, match, ctx) {
                     createdAt: Date.now(),
                     sourceTaskId: taskId,
                 });
-                const stillRead = await readResumeCtx(Promise.resolve(cs.getCtx(run.sessionId)));
+                const stillRead = await readResumeCtx(cs.getCtx(run.sessionId));
                 if (stillRead.kind === "corrupt") {
                     await cs.expire(wakeToken, cpScope).catch(() => undefined);
                     mintResult.corruptCtxWhere = stillRead.where;

package/dist/http/routes/session-sync.js

@@ -41,6 +41,11 @@ export async function handleSessionSync(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_store_required", "session sync requires a durable session store");
                 return;
             }
+            const historyStore = deps.fileHistoryStore;
+            if (historyStore === undefined) {
+                sendError(res, 501, "capability.snapshot_store_required", "session sync is not available on this deployment: file-history capture is turned off (FILE_HISTORY_CAPTURE=false), so there is no file history to export or import");
+                return;
+            }
             const scope = sessionOwnerScopeForWrite(req);
             if (!scope.fleetWide && scope.gateOwner === null) {
                 sendError(res, 401, "auth.unauthorized", "unauthorized");
@@ -76,7 +81,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                     return;
                 let out;
                 try {
-                    out = await exportSessionManifest(sessionId, deps.backend);
+                    out = await exportSessionManifest(sessionId, deps.backend, historyStore);
                 }
                 catch (e) {
                     if (sendSessionPolicyError(res, e))

package/dist/http/server.d.ts

@@ -146,7 +146,10 @@ export interface ServiceStoreDeps {
     toolResultStore?: ToolResultStoreFull;
     /** [ref] per-edited-file rewind history store. Present ⇒ the rewind capabilities are advertised; core uses it
      *  via RunnerDeps.fileHistoryStore (first-touch tracking + per-turn boundaries + tracked-set restore, ANY
-     *  env). Also the 2c history-transfer store (exportHistory/importHistory + blob negotiation faces). */
+     *  env). Also the 2c history-transfer store (exportHistory/importHistory + blob negotiation faces).
+     *  🔴 S-589:这是装配单点 `assembleFileHistory` 的**捕获脸**(后端 ∧ `FILE_HISTORY_CAPTURE`),不是「后端有没有这只店」
+     *  —— 旋钮关着时它缺席,rewind 族四位、能力词 `fileHistoryCapture` 与 2c sync 路由族一起按「店不在」走。
+     *  擦除(E21 / 孤儿 blob GC)不读本键,读 boot 侧的擦除脸。 */
     fileHistoryStore?: ServiceFileHistoryStore;
     /** D-1 通用文件上传(clay 拍 2026-07-27:独立附件 store,不骑 snapshot blob 面):enables
      *  POST/GET/DELETE /v1/attachments*。缺席 ⇒ 501(与其他可选 store 面同姿)。绑定/物化半场在

package/dist/http/server.js

@@ -94,7 +94,7 @@ export function createHttpServer(rawDeps) {
     }
     const { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, isFleetWide, sessionOwnerScope, sessionOwnerScopeForWrite, runOwnerOk, runSessionAcceptOk, readJson, readRawBody } = createRequestGuards({ deps });
     const { prepareSpec } = createAdmission({ deps, readJson, runnerFor });
-    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake, resumePlanReview } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
+    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
     const { denyExpiredApprovals, redeemParkedAsk } = createApprovalSweeps({ deps, resumeCheckpoint, mayDiscloseRowError });
     const { handle } = createDispatch({ deps, noteActivity, routeCtxBase, counters });
     const server = http.createServer((req, res) => {

package/dist/http/verify-rounds.d.ts

@@ -19,6 +19,6 @@ export declare function clampVerifyRounds(v: unknown): number;
 /** `undefined` when `body.verify` is not `true` (the caller didn't opt into the gate); otherwise the clamped
  *  rounds + (if `maxCostUsd` is a positive number) the same USD→micro-USD cost ceiling the cascade lane uses.
  *  Same expression that lived inline at all four verify/resume call sites in http/server.ts (fresh-submit,
- *  resumeCheckpoint, resumePreempted, resumePlanReview) — collected here VERBATIM ([ref] R9). */
+ *  resumeCheckpoint, resumePreempted, drivePlanReview — named resumePlanReview before S-609) — collected here VERBATIM ([ref] R9). */
 export declare function verifyRoundsFromBody(body: Pick<TaskRequestBody, "verify" | "verifyRounds" | "maxCostUsd">): VerifyRoundsSpec | undefined;
 //# sourceMappingURL=verify-rounds.d.ts.map

package/dist/memory-scope.d.ts

@@ -1,5 +1,6 @@
 import { FileMemoryEngineBackend, type TaskSpec } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
+import { type ExecutionLane } from "./execution-lane-caps.js";
 /** 前缀词表本体(供门/诊断读;判定一律走 {@link isV2ScopeKey},别在别处重写 startsWith 链)。 */
 export declare const V2_SCOPE_PREFIXES: readonly string[];
 /**
@@ -40,10 +41,13 @@ export declare function memoryScopeFor(config: ServiceConfig, principal?: string
  * (`MEMORY_ENGINE_REMOTE_LANE=allow`, e.g. ssh to a host on the same NFS mount).
  *
  * Pure posture probe (memoryEngineBackendFor consumes it; main.ts logs it): `undefined` = no plane split
- * (no remote lane, or the `host` lane), `dark` = split + fail-closed, `forced` = split + operator override.
+ * (the lane's file plane IS this worker's fs — `in-process` / `host`), `dark` = split + fail-closed, `forced` =
+ * split + operator override.
+ * S-602: the plane question reads the lane-caps table (`hostFilePlane`) — it used to be the hand-written synonym
+ * `lane === undefined || lane === "host"` (fold-ban gate D, R3); readings are unchanged lane by lane.
  */
 export declare function memoryEngineRemoteLanePosture(config: ServiceConfig): {
-    lane: string;
+    lane: ExecutionLane;
     posture: "dark" | "forced";
 } | undefined;
 /**

package/dist/memory-scope.js

@@ -1,5 +1,6 @@
 import { join } from "node:path";
 import { FileMemoryEngineBackend, resolveMemoryEngineRoot, deriveControlPlaneDir, formatUserScope, formatProjScope, normalizeMemorySpec } from "@sema-agent/core";
+import { executionLaneCaps, executionLaneOf } from "./execution-lane-caps.js";
 import { assertMemoryScopeWidth } from "./plugins/memory-key-guards.js";
 const V2_SCOPE_PREFIX_BY_KIND = {
     user: "user:",
@@ -26,8 +27,8 @@ export function memoryScopeFor(config, principal, projectId) {
     return config.memoryScope;
 }
 export function memoryEngineRemoteLanePosture(config) {
-    const lane = config.remoteExec?.provider;
-    if (lane === undefined || lane === "host")
+    const lane = executionLaneOf(config.remoteExec?.provider);
+    if (executionLaneCaps(lane).hostFilePlane === "supported")
         return undefined;
     return { lane, posture: config.memoryEngineRemoteLaneAllowed === true ? "forced" : "dark" };
 }

package/dist/observability/fail-open.d.ts

@@ -281,6 +281,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-287(`plugins/ensure-index.ts` 的 PG 臂):这口 PG **协议**面不认 `CREATE INDEX CONCURRENTLY`。今天唯一的真消费者是**仓内离线镜像的手搓 `PgQueryFn` 假件**(`pg-mem` 不是本仓依赖,`test/memory-embedder-fingerprint.test.ts` 头注已为此记过一次档,这里不重复那个错)。判据是**能力面**不是名字,且**只认阳性信号**:SQLSTATE ∈ {`0A000` feature_not_supported、`42601` syntax_error},或错误**完全不带 `code`**(= 不是驱动也不是服务端给的错误)⇒ 判「不认」,回退成普通 `CREATE INDEX IF NOT EXISTS`;**带任何其它 `code` 的一律原样抛** —— SQLSTATE 的 `55P03`/`57014`/`23505`/`42501`/`25001` 与 libuv 的 `ECONNRESET`/`EPIPE`/`ETIMEDOUT` 都在这一侧(⚠️ 不要按「5 位大写」的形状去分这两族:`EPIPE` 恰好也是 5 位大写)。放行的最坏后果 = 这一次建索引持表级 `SHARE` 锁阻塞该表的写(纯**性能/可用性**面,索引本身照样建成、语义零差别),而能走到这条臂的面**按定义**不是生产 PG。计数非零 = 有一口本以为是真 PG 的部署其实不认 CONCURRENTLY,运维要去看它到底是什么。detail = `<表>.<索引名>`。";
     };
+    readonly "server.assistant-inbox.objective-ctx-corrupt": {
+        readonly cls: "F";
+        readonly note: "S-609(`routes/approvals-assistant.ts` 的 `GET /v1/assistant/inbox`):某一行的续跑上下文(checkpoint_ctx)读出来是**坏体**(店的拒绝契约 `StoreCorruptError`;local = 档不是 JSON / 信封不合形,SQL = 列是合法 JSON 但不是一只对象)⇒ **这一行**的 `objective` 落 `null`,列表其余照常。放行的最坏后果 = inbox 上这一张卡不显示它属于哪个任务(纯展示位;这一格不参与任何决裁、续跑或门判 —— 续跑腿与 plan_review 门对同一行各自走读口、坏体一律响亮 500)。不放行的代价是整只 `summaries.map` 抛出 ⇒ 一行坏体打掉整个用户的 inbox。故 F 类;必须留痕,因为修前那句 `.catch(() => null)` 让「坏体」与「本来就没有」同形无痕(detail = 读口转述的 `where`,人拿它去修那一行)。缺席(行不在 / 店抖动)**不**记本 tag:那是读口的刻意保守,不是失败开放。";
+    };
 };
 /** 词表键推导的闭集类型——未登记的 tag 传不进 {@link recordFailOpen}(编译期拒)。 */
 export type FailOpenTag = keyof typeof FAIL_OPEN_TAGS;

package/dist/observability/fail-open.js

@@ -254,6 +254,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-287(`plugins/ensure-index.ts` 的 PG 臂):这口 PG **协议**面不认 `CREATE INDEX CONCURRENTLY`。今天唯一的真消费者是**仓内离线镜像的手搓 `PgQueryFn` 假件**(`pg-mem` 不是本仓依赖,`test/memory-embedder-fingerprint.test.ts` 头注已为此记过一次档,这里不重复那个错)。判据是**能力面**不是名字,且**只认阳性信号**:SQLSTATE ∈ {`0A000` feature_not_supported、`42601` syntax_error},或错误**完全不带 `code`**(= 不是驱动也不是服务端给的错误)⇒ 判「不认」,回退成普通 `CREATE INDEX IF NOT EXISTS`;**带任何其它 `code` 的一律原样抛** —— SQLSTATE 的 `55P03`/`57014`/`23505`/`42501`/`25001` 与 libuv 的 `ECONNRESET`/`EPIPE`/`ETIMEDOUT` 都在这一侧(⚠️ 不要按「5 位大写」的形状去分这两族:`EPIPE` 恰好也是 5 位大写)。放行的最坏后果 = 这一次建索引持表级 `SHARE` 锁阻塞该表的写(纯**性能/可用性**面,索引本身照样建成、语义零差别),而能走到这条臂的面**按定义**不是生产 PG。计数非零 = 有一口本以为是真 PG 的部署其实不认 CONCURRENTLY,运维要去看它到底是什么。detail = `<表>.<索引名>`。"
     },
+    "server.assistant-inbox.objective-ctx-corrupt": {
+        cls: "F",
+        note: "S-609(`routes/approvals-assistant.ts` 的 `GET /v1/assistant/inbox`):某一行的续跑上下文(checkpoint_ctx)读出来是**坏体**(店的拒绝契约 `StoreCorruptError`;local = 档不是 JSON / 信封不合形,SQL = 列是合法 JSON 但不是一只对象)⇒ **这一行**的 `objective` 落 `null`,列表其余照常。放行的最坏后果 = inbox 上这一张卡不显示它属于哪个任务(纯展示位;这一格不参与任何决裁、续跑或门判 —— 续跑腿与 plan_review 门对同一行各自走读口、坏体一律响亮 500)。不放行的代价是整只 `summaries.map` 抛出 ⇒ 一行坏体打掉整个用户的 inbox。故 F 类;必须留痕,因为修前那句 `.catch(() => null)` 让「坏体」与「本来就没有」同形无痕(detail = 读口转述的 `where`,人拿它去修那一行)。缺席(行不在 / 店抖动)**不**记本 tag:那是读口的刻意保守,不是失败开放。",
+    },
 };
 export function failOpenTagForDroppedFrame(frameType) {
     switch (frameType) {

package/dist/run-local.js

@@ -24,10 +24,9 @@ import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { createConfigProvider } from "./config-provider.js";
 import { applyEffective, applyCenterReadFace, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./config-center/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
-import { executionLaneHomeDir } from "./execution-lane-caps.js";
+import { executionLaneHomeDir, executionLaneOf } from "./execution-lane-caps.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "./project-memory.js";
-import { loadSkills } from "./capabilities/skills.js";
-import { toolsRunOnThisHost } from "./task-cwd.js";
+import { loadDeploymentSkills } from "./capabilities/skills.js";
 import { createRepoClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
 import { buildScenarios, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
@@ -424,7 +423,7 @@ export async function runLocal(argv, deps = {}) {
     const subRunner = new Runner(subRunnerDeps);
     const handslessRunner = new Runner(withoutExecutionEnv(runnerDeps));
     const handslessSubRunner = new Runner(withoutExecutionEnv(subRunnerDeps));
-    const skills = loadSkills(config.skillsDir, { toolsShareThisFilesystem: toolsRunOnThisHost(config) });
+    const skills = loadDeploymentSkills(config);
     const repoClient = config.gitApiBaseUrl ? createRepoClient(config.gitApiKind, config.gitApiBaseUrl, config.gitApiToken) : undefined;
     const webSearchCfg = webSearchConfigFromEnv();
     const webSearch = webSearchCfg ? createWebSearchBackend(webSearchCfg) : undefined;
@@ -489,7 +488,7 @@ export async function runLocal(argv, deps = {}) {
         ...(a2a ? { a2a } : {}),
         ...(Object.keys(limits).length > 0 ? { limits } : {}),
     }, config, workspaceDir, memoryEngine?.root);
-    logger.info("run_local_start", { scenario: scenarioName, model: spec.model, sessionId, exec: config.remoteExec?.provider ?? "in-process" });
+    logger.info("run_local_start", { scenario: scenarioName, model: spec.model, sessionId, exec: executionLaneOf(config.remoteExec?.provider) });
     const settleSessionBackground = async () => {
         const reaped = defaultTaskRegistry.reapSessionBackground(sessionId, scope);
         if (reaped === 0)

package/dist/session-sync.d.ts

@@ -140,7 +140,10 @@ export interface SessionManifest {
  * `null` ONLY for "session does not exist". (Named exportSessionManifest, NOT exportManifest, to avoid the collision
  * with the history store's own export verb.)
  */
-export declare function exportSessionManifest(sessionId: string, srcBackend: StoreBackend): Promise<{
+export declare function exportSessionManifest(sessionId: string, srcBackend: StoreBackend, 
+/** S-589:文件历史读**装配结果**(捕获脸),不直取 `srcBackend.fileHistory()` —— 「这台部署有没有文件历史店」
+ *  只在 `assembleFileHistory` 判一次。同一个后端铸的同一只店,四店同源的不变式不变。 */
+historyStore: ServiceFileHistoryStore): Promise<{
     manifest: SessionManifest;
     getBlob: BlobGetter;
 } | null>;

package/dist/session-sync.js

@@ -21,7 +21,7 @@ export async function replayFileHistory(store, scope, envelope, srcGetBlob, opts
 function ownerAware(backend) {
     return backend.session();
 }
-export async function exportSessionManifest(sessionId, srcBackend) {
+export async function exportSessionManifest(sessionId, srcBackend, historyStore) {
     const session = ownerAware(srcBackend);
     const listEntryIds = session.listEntryIds?.bind(session);
     if (!listEntryIds)
@@ -31,7 +31,7 @@ export async function exportSessionManifest(sessionId, srcBackend) {
         return null;
     const getLeafId = session.getLeafId?.bind(session);
     const leafId = getLeafId ? await getLeafId(sessionId) : null;
-    const fs = srcBackend.fileHistory();
+    const fs = historyStore;
     const fileHistory = typeof fs.exportHistory === "function" ? await fs.exportHistory(sessionId) : null;
     const policyStore = srcBackend.sessionPolicy();
     const policy = typeof policyStore.listBySession === "function"

package/dist/task-cwd.d.ts

@@ -56,12 +56,18 @@ export declare function cwdHonored(config: {
  * S-377 —— 「**工具跑的那台机器**就是本进程这台吗」。回答的是一个**文件系统同一性**问题,不是权限问题:
  * server 盘上的一条绝对路径(出厂 `SKILLS_DIR` 下某个技能自己的目录)对模型的工具**有没有意义**。
  *
+ * 判据 = 能力表两位的合取 {@link handsOnWorkerFilePlane}(`coreRemoteExecutionEnv ∧ hostFilePlane`,都读表,
+ * 本函数不手写任何车道词):
  * · `host`(run-on-this-machine,无容器)⇒ 真;
- * · `undefined`(in-process 单用户 lane)⇒ 真 —— 该 lane 根本没挂手(core 落 `StubExecutionEnv`),
- *   路径对谁都不可达,但它在**文件系统同一性**这条轴上确实是同一台机器,判真让规则只剩一条;
+ * · `in-process`(`REMOTE_EXEC` 未设)⇒ **假**(S-602,clay 裁 [ref] A 翻面;改前判真)—— 该 lane 根本
+ *   没挂手(core 落 `StubExecutionEnv`),「工具的盘」这句话在这里没有指称对象。改前的理由「文件系统同一性
+ *   这条轴上确实是同一台机器,判真让规则只剩一条」把**缺席折成了邻居**:wire 上的 `toolsOnThisHost` 因此
+ *   对无手部署说真,消费端的 doctor 据此说「工具在本机」。代价如实记:出厂目录形技能在 in-process 上不再带
+ *   `baseDir` —— core 律:缺席 ⇒ 结果逐字节同 baseDir 到货之前,而那条 lane 上本来也没有能读它的工具;
  * · 其余每一条(`k8s` / `e2b` / `ssh` / `adb` / `device` / `local-docker`)⇒ 假:工具的盘在别处,
  *   server 自己的路径在那边**不存在**,声明它等于给模型一条指向不存在文件的线索,还顺带把本机目录
- *   布局说了出去。
+ *   布局说了出去;
+ * · 认不出的词 ⇒ 假(fail-closed:没认出来的车道不许被当成「本机」)。
  *
  * 🔴 **为什么不复用 {@link cwdHonored}**:那一只是**权限**判据(单用户 ∧ host),它的 `requirePrincipal`
  * 那一半防的是「一个租户的输入把 agent 指向另一个租户的文件」。本谓词判的路径不是调用方给的,是**运维

package/dist/task-cwd.js

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { executionLaneOf, handsOnWorkerFilePlane } from "./execution-lane-caps.js";
 export const MAX_CWD_CHARS = 4_096;
 export function isValidCwd(cwd) {
     return (typeof cwd === "string" &&
@@ -21,7 +22,8 @@ export function cwdHonored(config) {
     return config.remoteExec?.provider === "host" && config.requirePrincipal !== true;
 }
 export function toolsRunOnThisHost(config) {
-    return config.remoteExec === undefined || config.remoteExec.provider === undefined || config.remoteExec.provider === "host";
+    const lane = executionLaneOf(config.remoteExec?.provider);
+    return lane !== undefined && handsOnWorkerFilePlane(lane);
 }
 export function deviceCwdHonored(config) {
     return config.remoteExec?.provider === "device";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.96.0",
+  "version": "7.97.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",