@capybara-hq/kernel 0.1.0-rc.24 → 0.1.0-rc.26

package/dist/tools/approvals.service.js

@@ -8,25 +8,29 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { randomUUID } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
 import { connectorToolKey, parseToolKey, validateAllowHost, } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { EventLog } from "../conversations/event-log.js";
 import { NETWORK_ASK_MAX_HOSTS, NETWORK_HOST_MAX_CHARS, } from "../conversations/events.js";
+import { conversationSourceOf } from "../conversations/source.js";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KernelEvents } from "../infra/events/kernel-events.js";
 import { LockService } from "../infra/lock/lock.service.js";
 import { WithLock } from "../infra/lock/with-lock.decorator.js";
-import { DevicePolicyService } from "../local-devices/device-policy.service.js";
+import { DevicePolicyService, } from "../local-devices/device-policy.service.js";
+import { pendingPolicyOpsOf } from "../local-devices/policy-summary.js";
 import { ORG_ROLES, roleAtLeast } from "../orgs/roles.js";
 import { RunResume } from "../runtime/run-jobs.js";
 import { rootConversationOf } from "../runtime/subagents/child.js";
-import { SandboxService } from "../sandbox/sandbox.service.js";
+import { deviceNotFound, SandboxService } from "../sandbox/sandbox.service.js";
 import { readScheduleSettings } from "../schedules/effective-settings.js";
 import { grantRefusalOf, NETWORK_GRANT_PREFIX, NETWORK_GRANT_SPEC_HASH, networkGrantRefusal, } from "../schedules/grant-rules.js";
 import { ScheduledTaskStore } from "../schedules/store.js";
@@ -54,6 +58,18 @@ export const NETWORK_ASK_TOOL_KEY = "Bash";
 /** The spec hash of a network ask (no tool definition is approved). */
 const NETWORK_ASK_SPEC_HASH = "network";
 const notFound = () => new ApiError("approval.not_found", "Approval not found");
+/**
+ * A decision refused before it wrote anything (the ask closed, expired or is not the account's to
+ * decide): the device op's outcome is still recorded in the same transaction.
+ */
+const refusedBeforeWrite = (e) => e instanceof ApiError &&
+    (e.code === "approval.already_decided" || e.code === "approval.not_found");
+/** A pending network ask's reason when its device change got no answer (`detail.attempt`). */
+const UNCONFIRMED_ATTEMPT = "The device did not confirm the change to its network rules; its next connection tells whether it took effect.";
+/** A pending network ask's reason when the device applied it but its chooser cannot decide. */
+const APPLIED_UNDECIDED_ATTEMPT = "The device allowed it, but the person who chose this can no longer decide this request.";
+/** A pending network ask's reason when its device change failed without a message. */
+const NOT_APPLIED_ATTEMPT = "The device did not apply the change to its network rules.";
 const iso = (v) => new Date(v).toISOString();
 const isRole = (v) => v !== null && ORG_ROLES.includes(v);
 /** The scopes of an approval without stored ones: a role escalation is approved only once. */
@@ -125,7 +141,10 @@ let ApprovalsService = class ApprovalsService {
     constructor(db, config, eventLog, events, txHost, schedules, 
     /** A trial approval is kept only for a tool the task may hold as a grant (its agent's tools). */
     registry, 
-    /** 「这台设备一直允许」 sends the `policy` op to the device before the decision is recorded. */
+    /**
+     * 「这台设备一直允许」 records the device change's intent, sends the `policy` op, then records
+     * its outcome with the decision.
+     */
     policies, 
     /** One decision of a network ask at a time, across replicas (the op is sent before the transaction). */
     lockService, 
@@ -390,12 +409,13 @@ let ApprovalsService = class ApprovalsService {
      * A network ask's decision (network ask-to-allow spec §5.2), one at a time per ask across
      * replicas: only the device owner (`requested_for`) decides, in a signed-in session (a personal
      * access token is refused; the route already refuses service and embed tokens); the allowed
-     * hosts are a subset of those asked. 「这台设备一直允许」 sends the `policy` op first, outside any
-     * transaction; when the device cannot be reached or lacks the feature the decision is recorded
-     * as a run grant with the reason, and when the device refuses (its owner takes no remote grants)
-     * as `always` with outcome `refused` and nothing granted. Then {@link decideIn} records what took
-     * effect and the run resumes after the commit; a change the device applied after the ask closed
-     * is audited (`late`) and answered with a 409 that says so.
+     * hosts are a subset of those asked. 「这台设备一直允许」 goes through the device change's intent
+     * ({@link decideAlways}): when the device cannot be reached or lacks the feature the decision is
+     * recorded as a run grant with the reason, and when the device refuses (its owner takes no
+     * remote grants) as `always` with outcome `refused` and nothing granted; the decision and the
+     * op's outcome are one transaction. Every decision resumes the run in its transaction and is
+     * announced after the commit; a change the device applied after the ask closed is audited
+     * (`late`) and answered with a 409 that says so.
      */
     async decideNetwork(orgId, id, accountId, body, actorTokenId, via) {
         const row = await this.db
@@ -457,18 +477,11 @@ let ApprovalsService = class ApprovalsService {
             }
             network = { wanted: granted, granted, outcome: "once", via };
             if (scope === "always") {
-                const applied = await this.applyAlways(orgId, detail.deviceId, granted, {
-                    approvalId: id,
-                    accountId,
-                    via,
-                });
-                network =
-                    applied === null
-                        ? { wanted: granted, granted, outcome: "always", via }
-                        : applied === "refused"
-                            ? // the device's owner takes no remote grants: nothing is allowed, not even this run
-                                { wanted: granted, granted: [], outcome: "refused", fallback: applied, via }
-                            : { wanted: granted, granted, outcome: "once_fallback", fallback: applied, via };
+                const decided = await this.decideAlways(orgId, ask, accountId, body, granted, via);
+                // null: the resolver decided it as this owner meanwhile (announced by its commit)
+                if (decided.toSeq !== null)
+                    await this.announceDecided(decided.record, decided.toSeq);
+                return decided.record;
             }
         }
         else {
@@ -479,46 +492,267 @@ let ApprovalsService = class ApprovalsService {
             }
             network = { wanted: [], granted: [], outcome: null, via };
         }
-        let decided;
+        const decided = await this.decideIn(orgId, id, accountId, body, actorTokenId, network);
+        await this.announceDecided(decided.record, decided.toSeq);
+        return decided.record;
+    }
+    /**
+     * 「这台设备一直允许」 (transactional outbox spec §7): the intent of the device change (naming the
+     * ask) is recorded, the `policy` op sent (no transaction open), then {@link settleNetworkOp}
+     * decides the ask and records the op's outcome in one transaction. When nothing could be sent
+     * (the device is offline, deleted, or its program lacks the feature) the decision is a run
+     * grant with the reason. The device's answer decides: applied → `always`; refused → `always`
+     * with outcome `refused`, nothing granted; no answer → a run grant (`once_fallback`, `offline`)
+     * while the op stays `unknown` for the machine's next hello or the resolver. A device that
+     * reconnects during the call and reports the op applied lets the resolver approve the ask as
+     * this owner first: that decision is returned (`toSeq` null: already announced), never a 409;
+     * when it granted other hosts than this call's (another of the owner's changes) and this call's
+     * change was not confirmed, `approval.already_decided` says so. A device deleted during the
+     * call is `device.not_found` (the op recorded unknown).
+     */
+    async decideAlways(orgId, ask, accountId, body, granted, via) {
+        const detail = ask.detail;
+        const accountName = (await this.displayNameOf(accountId)) ?? accountId;
+        let begun;
         try {
-            decided = await this.decideIn(orgId, id, accountId, body, actorTokenId, network);
+            begun = await this.policies.begin({
+                orgId,
+                deviceId: detail.deviceId,
+                change: { add: granted },
+                source: { approvalId: ask.id, accountId, accountName, via },
+            });
         }
         catch (e) {
-            // the device took the hosts, but a reply, the expiry or a stop closed the ask meanwhile:
-            // the change stands (the owner chose it), so it is audited and said
-            if (network.outcome === "always" &&
-                e instanceof ApiError &&
-                e.code === "approval.already_decided") {
-                await this.auditLateAllow(orgId, ask, network);
-                throw new ApiError("approval.already_decided", `The device now allows ${network.granted.join(", ")}; the request had already closed.`);
+            // the device was deleted meanwhile: nothing to write to, the run cannot go on there either
+            if (!(e instanceof ApiError && e.code === "device.not_found"))
+                throw e;
+            begun = { outcome: { applied: false, reason: "offline", message: e.message } };
+        }
+        if ("outcome" in begun) {
+            // nothing was sent: a run grant with the reason
+            const fallback = begun.outcome.applied ? "offline" : begun.outcome.reason;
+            return this.decideIn(orgId, ask.id, accountId, body, undefined, {
+                wanted: granted,
+                granted,
+                outcome: "once_fallback",
+                fallback,
+                via,
+            });
+        }
+        const { intent } = begun;
+        const sent = await this.policies.send(intent);
+        if (sent.notFound) {
+            // deleted during the call: nothing to grant on, the run cannot go on there either
+            await this.settleOpOnly({ machineId: intent.machineId, opId: intent.opId }, sent.result);
+            throw deviceNotFound();
+        }
+        const network = sent.result.outcome === "applied"
+            ? { wanted: granted, granted, outcome: "always", via }
+            : sent.result.outcome === "refused"
+                ? // the device's owner takes no remote grants: nothing is allowed, not even this run
+                    { wanted: granted, granted: [], outcome: "refused", fallback: "refused", via }
+                : { wanted: granted, granted, outcome: "once_fallback", fallback: "offline", via };
+        const settled = await this.settleNetworkOp(orgId, ask.id, accountId, body, network, {
+            machineId: intent.machineId,
+            opId: intent.opId,
+            result: sent.result,
+        });
+        if ("decided" in settled)
+            return settled.decided;
+        if (settled.closed.code === "approval.already_decided" && !settled.late) {
+            // the machine reconnected mid-call and reported the op: the resolver approved it as this
+            // owner, with this change; it is their decision, not a conflict
+            const now = await this.db
+                .selectFrom("approvals")
+                .selectAll()
+                .where("id", "=", ask.id)
+                .executeTakeFirst();
+            const record = now === undefined ? null : toRecord(now);
+            if (record?.status === "approved" &&
+                record.detail?.outcome === "always" &&
+                record.decidedBy === accountId) {
+                const stored = [...(record.detail.grantedHosts ?? [])].sort();
+                if (isDeepStrictEqual(stored, [...granted].sort()))
+                    return { record, toSeq: null };
+                // approved by another of this owner's changes (other hosts), and this call's change was
+                // not confirmed by the device: never report it as done
+                throw new ApiError("approval.already_decided", `The request was already approved to always allow ${stored.join(", ") || "no hosts"}; ` +
+                    `the device did not confirm allowing ${granted.join(", ")}.`);
             }
-            throw e;
         }
-        await this.announceDecided(decided.record, decided.toSeq);
-        return decided.record;
+        // the device took the hosts, but a reply, the expiry or a stop closed the ask meanwhile: the
+        // change stands (the owner chose it), audited late in the settle transaction, and said
+        if (settled.late && settled.closed.code === "approval.already_decided") {
+            throw new ApiError("approval.already_decided", `The device now allows ${granted.join(", ")}; the request had already closed.`);
+        }
+        throw settled.closed;
     }
-    /** `device.network_allowed` of a policy change that reached the device after the ask closed. */
-    async auditLateAllow(orgId, ask, network) {
+    /** Records only the op's outcome, in its own transaction (the ask is left as it is). */
+    async settleOpOnly(op, result) {
+        await this.policies.settleIn(op, result);
+    }
+    /**
+     * The resolve transaction of a network ask's device change: the ask decided as `network` says
+     * ({@link decideTx}: lock order conversation → approval → run), then the op's outcome recorded
+     * (`DevicePolicyService.settleIn`: the machine's row). When the ask closed meanwhile (a reply,
+     * the expiry, a stop) only the op's outcome is recorded, and a change the device applied is
+     * audited `device.network_allowed` with `late: true` in the same transaction.
+     */
+    async settleNetworkOp(orgId, id, accountId, body, network, op) {
+        let decided;
+        try {
+            decided = await this.decideTx(orgId, id, accountId, body, undefined, network);
+        }
+        catch (e) {
+            // refused before any write (closed, expired, gone): the op's outcome is recorded anyway
+            if (!refusedBeforeWrite(e))
+                throw e;
+            const late = await this.settleClosedIn(id, op, network.via);
+            return { closed: e, late };
+        }
+        await this.policies.settleIn(op, op.result);
+        return { decided };
+    }
+    /**
+     * The op's outcome for an ask that is no longer pending (in the caller's transaction): recorded,
+     * and a change the device applied audited `device.network_allowed` `late` (the change stands:
+     * the owner chose it; no inverse change is sent). True when it was audited late. `undecided`:
+     * the ask is still pending but the op's account can no longer decide it; the allow is audited
+     * without `late` (it is not after the ask) and the caller gives the ask the reason.
+     */
+    async settleClosedIn(approvalId, op, via, undecided = false) {
+        const pendingOp = await this.pendingOpOf(op.machineId, op.opId);
+        const out = await this.policies.settleIn(op, op.result);
+        if (out === null || pendingOp === null || op.result.outcome !== "applied")
+            return false;
+        const row = await this.db
+            .selectFrom("approvals")
+            .selectAll()
+            .where("id", "=", approvalId)
+            .executeTakeFirst();
+        if (!row)
+            return false;
+        const ask = toRecord(row);
         if (ask.detail === null)
-            return;
+            return false;
         await audit(this.db.db, {
-            actorAccountId: ask.requestedFor,
-            orgId,
+            actorAccountId: pendingOp.source.accountId,
+            orgId: ask.orgId,
             action: "device.network_allowed",
             target: ask.detail.deviceId,
             detail: {
                 approvalId: ask.id,
                 deviceId: ask.detail.deviceId,
-                hosts: network.granted,
+                hosts: pendingOp.add,
                 scope: "always",
                 outcome: "always",
-                late: true,
-                by: ask.requestedFor,
-                via: network.via,
+                ...(undecided ? { undecided: true } : { late: true }),
+                by: pendingOp.source.accountId,
+                via,
                 conversationId: ask.conversationId,
                 runId: ask.runId,
             },
         });
+        return true;
+    }
+    /** The live intent `opId` on machine `machineId` (null: settled already, or expired). */
+    async pendingOpOf(machineId, opId) {
+        const r = await this.db
+            .selectFrom("device_machines")
+            .select("pending_policy_ops")
+            .where("id", "=", machineId)
+            .executeTakeFirst();
+        const op = pendingPolicyOpsOf(r?.pending_policy_ops).find((o) => o.id === opId);
+        return op === undefined || op.until <= Date.now() ? null : op;
+    }
+    /**
+     * The `device-op-resolve` job's outcome of an op that answers network ask `op.source.approvalId`
+     * (transactional outbox spec §7.4), in the resolver's transaction: under the ask's locks
+     * (conversation, then the approval) the op is read again (settled meanwhile: nothing to do).
+     * Applied, and the ask still pending → approved `always` by the op's account (`via` as it
+     * asked), the run resumed in this transaction as every decision does; the ask closed → audited
+     * `late`; still pending but the op's account can no longer decide it → the allow audited (not
+     * late) and the ask left pending with `applied_undecided`. Not applied (refused, never received,
+     * interrupted) or still unknown → the op's outcome recorded and the ask left pending with the
+     * reason (`detail.attempt`) and an `approval_updated` event so the card shows it: no person is
+     * there to fall back to a run grant (D2).
+     */
+    async settleFromResolver(ref, result) {
+        const t = this.db.db;
+        const op = { machineId: ref.machineId, opId: ref.opId, result };
+        if (!(await this.lockConversationOf(ref.approvalId))) {
+            await this.policies.settleIn(op, result);
+            return;
+        }
+        const row = await t
+            .selectFrom("approvals")
+            .selectAll()
+            .select(sql `expires_at <= now()`.as("expired"))
+            .where("id", "=", ref.approvalId)
+            .forUpdate()
+            .executeTakeFirst();
+        const pendingOp = await this.pendingOpOf(ref.machineId, ref.opId);
+        if (row === undefined || pendingOp === null) {
+            await this.policies.settleIn(op, result);
+            return;
+        }
+        const ask = toRecord(row);
+        const open = ask.status === "pending" && !row.expired && ask.kind === "network";
+        const via = pendingOp.source.via;
+        if (result.outcome === "applied") {
+            if (!open) {
+                await this.settleClosedIn(ask.id, op, via);
+                return;
+            }
+            let decided;
+            try {
+                decided = await this.decideTx(ask.orgId, ask.id, pendingOp.source.accountId, { decision: "approve", scope: "always" }, undefined, { wanted: pendingOp.add, granted: pendingOp.add, outcome: "always", via });
+            }
+            catch (e) {
+                // the op's account may no longer decide it: the change stands, the ask waits with why
+                if (!refusedBeforeWrite(e))
+                    throw e;
+                if (await this.settleClosedIn(ask.id, op, via, true)) {
+                    await this.attemptIn(ask, ref.opId, {
+                        outcome: "applied_undecided",
+                        message: APPLIED_UNDECIDED_ATTEMPT,
+                    });
+                }
+                return;
+            }
+            await this.policies.settleIn(op, result);
+            afterCommit(() => this.announceDecided(decided.record, decided.toSeq));
+            return;
+        }
+        const out = await this.policies.settleIn(op, result);
+        if (out === null || !open || ask.detail === null)
+            return;
+        await this.attemptIn(ask, ref.opId, result.outcome === "unknown"
+            ? { outcome: "unknown", message: UNCONFIRMED_ATTEMPT }
+            : { outcome: "failed", message: out.applied ? NOT_APPLIED_ATTEMPT : out.message });
+    }
+    /**
+     * A pending network ask's reason (`detail.attempt`) and its `approval_updated` event (one per
+     * op and outcome), in the caller's transaction with the ask locked; notified after the commit.
+     */
+    async attemptIn(ask, opId, attempt) {
+        if (ask.detail === null)
+            return;
+        await this.db.db
+            .updateTable("approvals")
+            .set({ detail: JSON.stringify({ ...ask.detail, attempt }) })
+            .where("id", "=", ask.id)
+            .execute();
+        const written = await this.eventLog.appendIn(ask.conversationId, [
+            {
+                type: "approval_updated",
+                runId: ask.runId,
+                idemKey: `approval_updated:${ask.id}:${opId}:${attempt.outcome}`,
+                payload: { approvalId: ask.id, callId: ask.callId },
+            },
+        ]);
+        const toSeq = Math.max(...written.map((e) => e.seq));
+        afterCommit(() => this.eventLog.notify(ask.conversationId, toSeq));
     }
     /** The owner of a live device of the org (null: none, deleted, or of another org). */
     async deviceOwnerOf(orgId, deviceId) {
@@ -531,28 +765,6 @@ let ApprovalsService = class ApprovalsService {
             .executeTakeFirst();
         return d?.owner_account_id ?? null;
     }
-    /**
-     * Adds the hosts to the device's local policy (the `policy` op; never inside a transaction).
-     * Null when it was applied, else why not: the decision falls back to a run grant.
-     */
-    async applyAlways(orgId, deviceId, hosts, source) {
-        const accountName = (await this.displayNameOf(source.accountId)) ?? source.accountId;
-        try {
-            const out = await this.policies.apply({
-                orgId,
-                deviceId,
-                change: { add: hosts },
-                source: { ...source, accountName },
-            });
-            return out.applied ? null : out.reason;
-        }
-        catch (e) {
-            // the device was deleted meanwhile: nothing to write to, the run cannot go on there either
-            if (e instanceof ApiError && e.code === "device.not_found")
-                return "offline";
-            throw e;
-        }
-    }
     /** After the commit: the decision's events reach the page, the run's waits and IM delivery. */
     async announceDecided(record, toSeq) {
         await this.eventLog.notify(record.conversationId, toSeq);
@@ -576,7 +788,14 @@ let ApprovalsService = class ApprovalsService {
     }
     // its own transaction (as the legacy one was): `approval.decided` is emitted only after the
     // decision committed, even when a caller has a transaction open
-    async decideIn(orgId, id, accountId, body, actorTokenId, network) {
+    decideIn(orgId, id, accountId, body, actorTokenId, network) {
+        return this.decideTx(orgId, id, accountId, body, actorTokenId, network);
+    }
+    /**
+     * A decision in the caller's transaction: lock order conversation → approval → run (the resume).
+     * Refuses (`approval.already_decided`, `approval.not_found`, …) before any write.
+     */
+    async decideTx(orgId, id, accountId, body, actorTokenId, network) {
         const t = this.db.db;
         // lock order: the conversation, the approval, then the run (as a stop of the waiting run)
         if (!(await this.lockConversationOf(id, orgId)))
@@ -611,7 +830,7 @@ let ApprovalsService = class ApprovalsService {
         if (locked.expired) {
             throw new ApiError("approval.already_decided", "Approval has expired");
         }
-        // a network ask is decided only through decideNetwork (its policy op went first)
+        // a network ask is decided only with what took effect (decideNetwork, the op's resolver)
         if ((before.kind === "network") !== (network !== undefined)) {
             throw new Error(`approval ${id} is of kind ${before.kind}`);
         }
@@ -814,6 +1033,8 @@ let ApprovalsService = class ApprovalsService {
             disabledTools: def?.disabledTools ?? [],
             subagentTools: def?.subagentTools,
             subagents: def?.subagents,
+            // the tools of the trial run's conversation, where the approval was asked
+            source: await conversationSourceOf(t, a.conversationId),
         });
         const tool = tools.find((x) => x.key === a.toolKey);
         const { forbiddenTools } = await readScheduleSettings(t, this.config, a.orgId);
@@ -975,21 +1196,34 @@ let ApprovalsService = class ApprovalsService {
         return out;
     }
     /**
-     * 在调用方的事务内（`mandatory`）取消某组织里指定由 `accountId` 处理（`requested_for`）的全部 pending 审批（成员离职），
-     * 走与 {@link cancelPendingIn} 相同的取消路径：置 cancelled、写 `approval_decided{cancelled}`（处理人为 null）。
-     * 返回被取消的记录与各会话写到的最大 seq；调用方提交后发布事件（并可续跑对应运行）。
+     * The conversations of `orgId` holding a pending approval `accountId` is asked to decide
+     * (`requested_for`), read without locks: offboarding locks them, by tree root first
+     * (`lockConversationTrees`), before {@link cancelPendingFor}.
      */
-    async cancelPendingFor(orgId, accountId) {
-        const t = this.db.db;
-        // the conversations first, in id order (lock order: conversation, then approval rows)
-        const convs = await this.lockConversations(t
+    async pendingConversationsFor(orgId, accountId) {
+        const rows = await this.db
             .selectFrom("approvals")
             .select("conversation_id")
+            .distinct()
             .where("org_id", "=", orgId)
             .where("requested_for", "=", accountId)
-            .where("status", "=", "pending"));
-        // only the conversations locked above: an approval asked meanwhile in another one is left to
-        // the run's stop or the sweep, so no conversation is locked after a row
+            .where("status", "=", "pending")
+            .execute();
+        return rows.map((r) => r.conversation_id);
+    }
+    /**
+     * In the caller's transaction (`mandatory`; offboarding): cancels every pending approval of
+     * `orgId` that `accountId` is asked to decide (`requested_for`) in `conversationIds`, the
+     * conversations the caller already locked (by tree root first, `lockConversationTrees`; lock
+     * order: conversations, then approval rows), along the same path as {@link cancelPendingIn}:
+     * `cancelled`, `approval_decided{cancelled}` with no decider. An approval asked meanwhile in
+     * another conversation is left to its run's stop, so no conversation is locked after a row.
+     * Returns the cancelled records and the highest seq written per conversation; the caller
+     * publishes after the commit.
+     */
+    async cancelPendingFor(orgId, accountId, conversationIds) {
+        const t = this.db.db;
+        const convs = [...conversationIds];
         if (convs.length === 0)
             return { records: [], seqs: new Map() };
         const rows = await t
@@ -1293,10 +1527,25 @@ __decorate([
 ], ApprovalsService.prototype, "decideNetwork", null);
 __decorate([
     Transactional()
-], ApprovalsService.prototype, "auditLateAllow", null);
+], ApprovalsService.prototype, "settleOpOnly", null);
+__decorate([
+    Transactional()
+], ApprovalsService.prototype, "settleNetworkOp", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], ApprovalsService.prototype, "settleClosedIn", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], ApprovalsService.prototype, "settleFromResolver", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], ApprovalsService.prototype, "attemptIn", null);
 __decorate([
     Transactional({ propagation: "requires_new" })
 ], ApprovalsService.prototype, "decideIn", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], ApprovalsService.prototype, "decideTx", null);
 __decorate([
     Transactional({ propagation: "mandatory" })
 ], ApprovalsService.prototype, "keepTrialGrant", null);

package/dist/tools/builtins/sandbox/task-output.js

@@ -77,14 +77,18 @@ const notFound = (id) => new ToolError(`No background task ${clip(id, 40)} in th
  */
 export const subagentNotTaskText = (id) => `${clip(id, 40)} is a sub-agent, not a background task. Its report arrives in this conversation as a notification when it hands back or finishes. Don't poll or sleep for it: keep working or end your turn. Use SendMessage to give it more instructions.`;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-/** {@link notFound}, or {@link subagentNotTaskText} when `id` is a sub-agent of the caller's tree. */
-async function missingTask(env, ctx, id) {
+/** Whether `id` is the agentId of a sub-agent in the caller's tree (not a task id). */
+async function isSubagentId(env, ctx, id) {
     const trimmed = id.trim();
-    if (env.subagents !== undefined &&
+    return (!TASK_ID_RE.test(id) &&
+        env.subagents !== undefined &&
         UUID_RE.test(trimmed) &&
-        (await env.subagents.inTree(sandboxConversationOf(ctx), trimmed.toLowerCase()))) {
-        return new ToolError(subagentNotTaskText(trimmed));
-    }
+        (await env.subagents.inTree(sandboxConversationOf(ctx), trimmed.toLowerCase())));
+}
+/** {@link notFound}, or {@link subagentNotTaskText} when `id` is a sub-agent of the caller's tree. */
+async function missingTask(env, ctx, id) {
+    if (await isSubagentId(env, ctx, id))
+        return new ToolError(subagentNotTaskText(id.trim()));
     return notFound(id);
 }
 /**
@@ -286,6 +290,17 @@ export function taskOutputTool(deps) {
         async run(input, ctx) {
             const { task_id, block = true, timeout } = input;
             const env = await taskEnv(deps, ctx);
+            // A sub-agent's agentId is answered, not refused: where its report arrives is the answer
+            // (acceptance 2026-11-13: guidance the model is expected to follow is not a failed call).
+            // TaskStop keeps the error: it cannot stop a sub-agent.
+            if (await isSubagentId(env, ctx, task_id)) {
+                const id = clip(task_id.trim(), 40);
+                return {
+                    content: [{ type: "text", text: subagentNotTaskText(task_id.trim()) }],
+                    isError: false,
+                    display: display(`查看子智能体：${id}`, `Checked sub-agent: ${id}`),
+                };
+            }
             let task = await ownedTask(env, ctx, task_id);
             await recheckDevice(env, ctx);
             if (block && task.status === "running") {

package/dist/tools/device-op-resolver.d.ts

@@ -0,0 +1,40 @@
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { DevicePolicyService } from "../local-devices/device-policy.service.js";
+import type { DeviceOpResolveData } from "../local-devices/policy-op-jobs.js";
+import { ApprovalsService } from "./approvals.service.js";
+/**
+ * The `device-op-resolve` job (transactional outbox spec §7): records what became of a device
+ * policy op whose outcome its caller did not record (a crash between the call and the resolve
+ * transaction, an answer that never came). Owed by the op's intent for when the op can no longer
+ * reach the machine, and by a hello that reported the op (`device-op-reported-<opId>`).
+ *
+ * An op without an entry any more is resolved already: a no-op. Otherwise the outcome is the one
+ * the hello reported, else the machine's answer to a read-only `policyStatus`: `applied` →
+ * recorded applied; `refused`, never received (`unknown` to the machine, or `absent` from its
+ * hello, once the op can no longer reach it) → failed; `started` (the machine stopped between
+ * its log and its answer), once the op can no longer reach it → applied when the policy it
+ * reports holds the change, else failed (`interrupted`); no answer (`offline`) → `unknown`, left
+ * for the machine's next hello. It never sends the change
+ * again (a widening after its ask closed is not allowed). An op that answers a network ask
+ * decides it when applied and the ask is still pending, else leaves it pending with the reason
+ * (`ApprovalsService.settleFromResolver`).
+ */
+export declare class DeviceOpResolver {
+    private readonly db;
+    readonly txHost: TransactionHost;
+    private readonly policies;
+    private readonly approvals;
+    constructor(db: KernelDb, txHost: TransactionHost, policies: Pick<DevicePolicyService, "outcomeOf" | "settleIn">, approvals: Pick<ApprovalsService, "settleFromResolver">);
+    resolve(data: DeviceOpResolveData): Promise<void>;
+    /**
+     * The outcome a hello reported; a refusal's message (a hello carries none) is the machine's
+     * answer to `policyStatus` when it is connected.
+     */
+    private reportedResult;
+    /**
+     * The resolve transaction: the op's outcome, and the network ask it answers decided or given
+     * the reason in the same transaction (`ApprovalsService.settleFromResolver`).
+     */
+    private settle;
+}