@sema-agent/server 7.101.1 → 7.103.0

package/dist/plugins/remote-env-host.js

@@ -7,11 +7,10 @@ import { openSync, closeSync, readSync, statSync, truncateSync, unlinkSync, mkdi
 import { StringDecoder } from "node:string_decoder";
 import { armPipeDestroyGrace, numEnvOr, SYMLINK_CHAIN_MAX_HOPS } from "./remote-shell.js";
 import { hostBackgroundShellEnabled, hostExecSpoolEnabled } from "../config.js";
-import { resolveHostShell, hostShell, spawnGroupOptions, killTreeHard, killTreeSoft, collapseWin32EnvKeys, adoptHostForegroundChild } from "./host-platform.js";
+import { resolveHostShell, hostShell, spawnGroupOptions, killTreeHard, killTreeSoft, hardKillGroupNow, collapseWin32EnvKeys, adoptHostForegroundChild } from "./host-platform.js";
 import { BackgroundShellManager, seedMemStream, feedMemStream, drainMemStream } from "./background-shell-support.js";
 import { FileError, ExecutionError, RemoteExecutionError, RollingTailBuffer, markTruncated, SchedulerError, BackgroundShellError, } from "@sema-agent/core";
-import { recordSecretEnvScrub } from "../observability/secret-env-scrub.js";
-import { allowlistedEnv, scrubServerSecrets } from "../server-secret-env.js";
+import { allowlistedEnv, hostSubprocessEnv } from "../server-secret-env.js";
 import { trackEphemeralHostWorkspace, untrackEphemeralHostWorkspace } from "./host-workspace-registry.js";
 const PROVIDER = "host";
 const DEFAULT_COMMAND_TIMEOUT_MS = 30 * 60_000;
@@ -21,7 +20,7 @@ const HOST_BG_DEFAULT_TIMEOUT_SEC = numEnvOr("HOST_BG_DEFAULT_TIMEOUT_SEC", 300,
 const HOST_BG_MAX_TIMEOUT_SEC = numEnvOr("HOST_BG_MAX_TIMEOUT_SEC", 1800, HOST_BG_DEFAULT_TIMEOUT_SEC);
 const HOST_BG_READ_CAP = numEnvOr("HOST_BG_READ_CAP", 1024 * 1024, 64 * 1024);
 const HOST_BG_FILE_CAP = numEnvOr("HOST_BG_FILE_CAP", 64 * 1024 * 1024, HOST_BG_READ_CAP);
-const HOST_BG_KILL_GRACE_MS = numEnvOr("HOST_BG_KILL_GRACE_MS", 1000, 0);
+export const HOST_BG_KILL_GRACE_MS = numEnvOr("HOST_BG_KILL_GRACE_MS", 1000, 0);
 const HOST_BG_MEM_CAP = numEnvOr("HOST_BG_MEM_CAP", 8 * 1024 * 1024, 64 * 1024);
 const ok = (value) => ({ ok: true, value });
 const UNC_SPELLING = /^[\\/]{2}[^\\/]+[\\/]+[^\\/]/;
@@ -253,7 +252,7 @@ export class RemoteHostExecutionEnv {
                         await fs.rm(dir, { recursive: true, force: true }).catch(() => { });
                         throw new BackgroundShellError("spawn_failed", "host background spawn produced no pid");
                     }
-                    return { pid, dir, outPath, errPath, stdoutCursor: 0, stderrCursor: 0 };
+                    return { pid, child, dir, outPath, errPath, stdoutCursor: 0, stderrCursor: 0 };
                 });
             },
             async read(state) {
@@ -334,6 +333,11 @@ export class RemoteHostExecutionEnv {
                 if (state.dir)
                     await fs.rm(state.dir, { recursive: true, force: true }).catch(() => { });
             },
+            killNow(state) {
+                if (state.child.exitCode !== null || state.child.signalCode !== null)
+                    return "already_gone";
+                return hardKillGroupNow(state.pid);
+            },
         };
     }
     spawnBackground(command, options) {
@@ -362,7 +366,7 @@ export class RemoteHostExecutionEnv {
                 child.off("close", onClose);
                 child.off("error", onErrEvt);
             };
-            return { pid, stdoutCursor: 0, stderrCursor: 0, mem, detachCleanup };
+            return { pid, child, stdoutCursor: 0, stderrCursor: 0, mem, detachCleanup };
         });
         return adopted?.shellId;
     }
@@ -372,6 +376,9 @@ export class RemoteHostExecutionEnv {
     killBackground(shellId) {
         return this.bgManager.kill(shellId);
     }
+    killBackgroundNow(shellId) {
+        return this._bgManager?.killNow(shellId) ?? "already_gone";
+    }
     disposeBackgroundShells(opts) {
         return this._bgManager ? this._bgManager.dispose(opts) : Promise.resolve();
     }
@@ -782,7 +789,7 @@ export class RemoteHostExecutionEnv {
                 child.off("close", onClose);
                 child.off("error", onErrEvt);
             };
-            return { pid, dir: spool.dir, outPath: spool.outPath, errPath: spool.errPath, stdoutCursor: cursors.out, stderrCursor: cursors.err, detachCleanup, ...(fgRemovedBytes > 0 ? { preSpoolBase: fgRemovedBytes, pendingDropped: fgRemovedBytes } : {}) };
+            return { pid, child, dir: spool.dir, outPath: spool.outPath, errPath: spool.errPath, stdoutCursor: cursors.out, stderrCursor: cursors.err, detachCleanup, ...(fgRemovedBytes > 0 ? { preSpoolBase: fgRemovedBytes, pendingDropped: fgRemovedBytes } : {}) };
         });
         return adopted?.shellId;
     }
@@ -1309,9 +1316,7 @@ export class RemoteHostExecutionEnv {
             base = allowlistedEnv(mode, process.env);
         }
         else {
-            const findings = [];
-            base = scrubServerSecrets(process.env, findings);
-            recordSecretEnvScrub("server.remote-env-host.inherit-scrub", findings, []);
+            base = hostSubprocessEnv({ site: "server.remote-env-host.inherit-scrub", allow: [] });
         }
         if (this.cfg.env)
             Object.assign(base, this.cfg.env);

package/dist/project-memory.js

@@ -3,8 +3,7 @@ import { execFile } from "node:child_process";
 import { createHmac, randomBytes } from "node:crypto";
 import hostPath, { isAbsolute, join } from "node:path";
 import { announceInstructionSource } from "./instruction-source-notice.js";
-import { recordSecretEnvScrub } from "./observability/secret-env-scrub.js";
-import { scrubServerSecrets } from "./server-secret-env.js";
+import { gitSubprocessEnv } from "./server-secret-env.js";
 import { redactSecrets } from "./trace/redact.js";
 const INSTRUCTION_FILE_CHAIN = ["CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md", ".claude/AGENTS.md"];
 const INSTRUCTION_READ_CAP = 24 * 1024;
@@ -72,11 +71,9 @@ async function readChainMember(root, rel, maxBytes, truncatedFlag) {
 }
 function git(root, args, maxBytes) {
     const safeArgs = ["-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", ...args];
-    const scrubFindings = [];
-    const scrubbedEnv = scrubServerSecrets(process.env, scrubFindings);
-    recordSecretEnvScrub("server.project-memory.git-subprocess", scrubFindings, []);
+    const env = gitSubprocessEnv({ site: "server.project-memory.git-subprocess", isolateConfig: true });
     return new Promise((res) => {
-        execFile("git", safeArgs, { cwd: root, timeout: 5000, maxBuffer: maxBytes, env: { ...scrubbedEnv, GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_SYSTEM: "/dev/null" } }, (err, stdout, stderr) => {
+        execFile("git", safeArgs, { cwd: root, timeout: 5000, maxBuffer: maxBytes, env }, (err, stdout, stderr) => {
             if (!err)
                 return res({ out: stdout.trim() });
             const e = err;

package/dist/run-local.js

@@ -52,6 +52,7 @@ import { createMetrics } from "./observability/metrics.js";
 import { installSecretEnvScrubRecorder } from "./observability/secret-env-scrub.js";
 import { createHostLspManager } from "./host-lsp-manager.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { installOutboundDispatcher } from "./outbound-dispatcher.js";
 export function parseArgs(argv) {
     let objective;
     let root;
@@ -267,6 +268,7 @@ export async function runLocal(argv, deps = {}) {
     const memoryEngineIncident = createMemoryEngineIncidentSink({ logger, metrics });
     installSecretEnvScrubRecorder({ logger, metrics });
     logConfigDiagnostics(logger);
+    installOutboundDispatcher(logger);
     const configProvider = createConfigProvider({
         provider: config.configProvider ?? "local",
         ...(config.configLocalDir ? { localDir: config.configLocalDir } : { localDir: root }),

package/dist/server-secret-env.d.ts

@@ -1,40 +1,48 @@
 /**
- * 7.99.0 合并复审 F7(web-admin [ref] 实测;安全轴;DEBTS S-684)—— 子进程 env 交出去之前的**本仓**密钥剥除。
+ * 7.99.0 合并复审 F7(web-admin [ref] 实测;安全轴;DEBTS S-684)—— 子进程 env 交出去之前的**本仓**密钥剥除;7.103.0(车OT,
+ * S-684 残余按类收口)起也是本包**宿主子进程 env 的唯一组合点**。
  *
  * ## 病
- * 本仓两条子进程腿 —— 模型可驱动的 host shell(`inheritEnv:"scrub"` 缺省腿,`plugins/remote-env-host.ts`)与
+ * 本仓的子进程腿 —— 模型可驱动的 host shell(`inheritEnv:"scrub"` 缺省腿,`plugins/remote-env-host.ts`)与
  * project-memory 的 git 子进程(`project-memory.ts`)—— 此前只调 core 的 `scrubSecretEnv`。它按键名**形状**判
  * (`*_KEY` / `*_TOKEN` / `*_SECRET` …),而本仓自己的凭据键里有形状规则认不出的:`SERVICE_AUTH_TOKENS`(复数,
  * per-system 凭据表)、`APPROVAL_HMAC_KEYS`(直连门 HMAC 密钥集)、`OTEL_EXPORTER_OTLP_HEADERS`(常载鉴权头)⇒
- * 原样进子进程,模型选的一句 `printenv` 就读得到。
+ * 原样进子进程,模型选的一句 `printenv` 就读得到。S-684 残余(7.103.0):另外三条宿主腿连 core 的形状剥都没过 —— leader 推送的
+ * git(`leader/wire.ts`)、center-plugins 克隆的 git(`capabilities/center-plugins.ts`)、bake-runner 交给 build.sh 与主机命令的
+ * env(`bake-runner/main.ts`,连 runner 自己的 `BAKE_RUNNER_TOKEN`)。
  *
  * ## 规则(一句)
- * 本仓**知道**哪些 env 键是凭据 —— 配置目录(`config-catalog.ts`)里 `type:"secret"` 的每一行,从目录机器派生,
- * 不手抄第二份名单 —— 这些键按名剥;其余照旧交 core 按形剥。{@link scrubServerSecrets} = 目录派生剥除 ∘ core
- * `scrubSecretEnv`,本仓三条子进程腿(host shell / git 子进程 / 本地语言服务器,后者见 `host-lsp-manager.ts`)都只调它。
+ * 本包任何进程在宿主上 spawn 的子进程:env = {@link hostSubprocessEnv} = {@link scrubServerSecrets}(process.env) ∪ 部署方点名放回的键
+ * (只在运维真可能要传东西的腿上有旋钮),剥掉的键经一个登记过的 `SecretEnvScrubSite` 留痕;git 腿再叠 git 自己的两件
+ * ({@link gitSubprocessEnv})。各腿只调这两只 —— 不许再有内联拼装(类级门在 `test/secret-env-scrub-host-legs.test.ts`)。
+ *
+ * {@link scrubServerSecrets} = core `scrubSecretEnv`(按形)∘ 本仓按名两臂:
+ *  · 目录臂 —— 配置目录(`config-catalog.ts`)里 `type:"secret"` 的每一行,从目录机器派生,不手抄第二份名单;
+ *  · 名单型旋钮臂 —— `ENV_NAME_ALLOWLIST_KNOBS` 的每一只(`env-name-allowlist-knobs.ts`,表键派生):名单**原文**可能夹着一枚被错展开进来
+ *    的令牌,按凭据类对待。服务侧三只(`LSP_ENV_ALLOW` S-699 / `E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV` S-713)同时是目录 secret 行,
+ *    目录臂先认;本臂接住的是**不在服务目录里**的那一只 —— bake-runner 的 `BAKE_ENV_ALLOW`(它不是服务进程的配置)。
  * core 形状规则的缺口由 core 源头修 —— 7.30.1 #1072 已补 `KEYS|TOKENS|PASSWORDS`(S-616 提货),目录臂独担的只剩
- * `OTEL_EXPORTER_OTLP_HEADERS`(`*_HEADERS` 不在形状规则射程,是边界不是缺陷票)与三只名单型旋钮 `LSP_ENV_ALLOW`(S-699)/
- * `E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV`(S-713):原文可能夹着一枚被错展开进来的令牌,按凭据类登记 —— 形状规则按名判,本来就不该
- * 认它们)。本层不改 core 的判据,也不自造
- * 第二份形状规则。目录里加一个 secret 型键,三条腿当场就剥它。
+ * `OTEL_EXPORTER_OTLP_HEADERS`(`*_HEADERS` 不在形状规则射程,是边界不是缺陷票)与名单型旋钮(形状规则按名判,本来就不该认它们)。
+ * 本层不改 core 的判据,也不自造第二份形状规则。目录里加一个 secret 型键 / 叶表加一只名单型旋钮,每条腿当场就剥它。
  *
  * ## 不变的面
  * `inheritEnv:"all"`(显式全继承)与显式 allowlist 两形不经本函数,行为逐字不变;调用方显式传入的 env
  * (`cfg.env` / 单次命令的 `env`)照旧原样覆盖在剥除结果之上。
  *
- * ## 点名放行(S-699 / S-713,一只谓词三处用)
- * {@link allowlistedEnv} 是本仓「一张名单点到哪些 env 键,就把它们从源 env **原样**交给子进程」的唯一实现。三处调用:
- * host shell 的 `inheritEnv:[names]`(`plugins/remote-env-host.ts`)、本地语言服务器的 `LSP_ENV_ALLOW`(`host-lsp-manager.ts`)、
- * 沙箱带外 env 的 `E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV`(`config.ts`,S-713 起;此前那里是第三份自写的循环)。三只名单型
- * 旋钮的**名单**另由 `config.ts` 的同一只解析器 `parseEnvNameAllowlist` 判形(形错拒启 / 源里没有的名按序号 warn),本函数只管取值。
- * 「点名」在三处同义:点到的键原样带值(空串值照带),密钥形也照过(点名 = 部署方显式承担);源里没有的名不产生条目。
+ * ## 点名放行(S-699 / S-713,一只谓词各处用)
+ * {@link allowlistedEnv} 是本仓「一张名单点到哪些 env 键,就把它们从源 env **原样**交给子进程」的唯一实现。调用:
+ * host shell 的 `inheritEnv:[names]`(`plugins/remote-env-host.ts`,hermetic 形)、{@link hostSubprocessEnv}(剥后放回形:本地语言服务器的
+ * `LSP_ENV_ALLOW`、bake-runner 的 `BAKE_ENV_ALLOW`)、沙箱带外 env 的 `E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV`(`config.ts`,S-713 起)。
+ * 名单型旋钮的**名单**另由 `config.ts` 的同一只解析器 `parseEnvNameAllowlist` 判形(形错拒启 / 源里没有的名按序号 warn),本函数只管取值。
+ * 「点名」在各处同义:点到的键原样带值(空串值照带),密钥形也照过(点名 = 部署方显式承担);源里没有的名不产生条目。
  * 沙箱两腿不继承本进程环境:进沙箱的本进程值只有点到的键(与 host shell 的 hermetic 形同一侧)。
- * host shell 与语言服务器**只在没点到的键上**不同,这是有意保留的差别:host shell 的 `string[]` 形是 hermetic 白名单(与 core
- * `NodeExecutionEnv` 同名选项同义,没点到的一律不继承);语言服务器在 {@link scrubServerSecrets} 的结果之上放回点名键
- * (没点到的照缺省剥,`PATH` / `HOME` 这类非密钥键照常在 —— hermetic 形会让语言服务器当场找不到自己的工具链)。
- * 两处都不放宽对方:把 host shell 改成「剥后放回」= 在模型可驱动的 shell 上放宽,把语言服务器改成 hermetic = 功能当场失灵。
+ * host shell 与「剥后放回」形**只在没点到的键上**不同,这是有意保留的差别:host shell 的 `string[]` 形是 hermetic 白名单(与 core
+ * `NodeExecutionEnv` 同名选项同义,没点到的一律不继承);语言服务器 / bake-runner 在 {@link scrubServerSecrets} 的结果之上放回点名键
+ * (没点到的照缺省剥,`PATH` / `HOME` 这类非密钥键照常在 —— hermetic 形会让子进程当场找不到自己的工具链)。
+ * 两形都不放宽对方:把 host shell 改成「剥后放回」= 在模型可驱动的 shell 上放宽,把后者改成 hermetic = 功能当场失灵。
  */
 import { type SecretEnvFinding } from "@sema-agent/core";
+import { type SecretEnvScrubSite } from "./observability/secret-env-scrub.js";
 /** 目录派生臂的一条剥除记录(形同 core 的 `SecretEnvFinding`:键名 / 规则 / 置信度 / 来源;值永不携带)。
  *  `source` 用本仓自己的词 `server-config-catalog`,与 core 的 `secret-env` 分开 —— 读观测面的人要分得清
  *  「形状规则剥的」与「本仓目录点名剥的」(后者多出来的那部分正是 core 形状规则的缺口)。 */
@@ -44,16 +52,81 @@ export interface CatalogSecretEnvFinding {
     readonly confidence: "high";
     readonly source: "server-config-catalog";
 }
-/** 本仓两条子进程腿的剥除记录:core 的形状臂 ∪ 本仓的目录臂。 */
-export type ServerSecretEnvFinding = SecretEnvFinding | CatalogSecretEnvFinding;
+/** 名单型旋钮臂的一条剥除记录(形同上;`source` 用自己的词 —— 读观测面的人要分得清「目录点名剥的」与「名单型旋钮原文按凭据类剥的」)。 */
+export interface NameListKnobEnvFinding {
+    readonly key: string;
+    readonly kind: "name-list-knob";
+    readonly confidence: "high";
+    readonly source: "server-name-list-knob";
+}
+/** 随残组扣下的 git 配置组成员(codex r1 C1;见 {@link hostSubprocessEnv} 的组不变量)。它本身不是凭据 —— 是因为同组的某个成员被剥掉、
+ *  整组已不成形而一起扣下的;`kind` 单列一桶,读观测面的人分得清「剥的」与「随组扣下的」。 */
+export interface GitConfigGroupEnvFinding {
+    readonly key: string;
+    readonly kind: "git-config-group";
+    readonly confidence: "high";
+    readonly source: "server-git-config-group";
+}
+/** 本仓子进程腿的扣下记录:core 的形状臂 ∪ 本仓的目录臂 ∪ 名单型旋钮臂 ∪ 随残组扣下的 git 配置组成员。 */
+export type ServerSecretEnvFinding = SecretEnvFinding | CatalogSecretEnvFinding | NameListKnobEnvFinding | GitConfigGroupEnvFinding;
 /** 配置目录里 `type:"secret"` 的 env 名(大写 —— Windows 的 env 名不分大小写,按大写比才不会漏)。 */
 export declare const CATALOG_SECRET_ENV_NAMES: ReadonlySet<string>;
 /**
- * 先交 core 按形剥,再按目录名剥它漏下的。`findings` 是调用方持有的收集器(交给 `recordSecretEnvScrub` 留痕):
+ * 先交 core 按形剥,再按目录名、名单型旋钮名剥它漏下的。`findings` 是调用方持有的收集器(交给 `recordSecretEnvScrub` 留痕):
  * 形状臂剥掉的记 core 的 finding;目录臂只记**形状臂漏下、被目录点名剥掉**的键 —— 于是既有的形状臂计数不变,
- * 目录臂的计数恰好就是 core 形状规则的缺口读数。
+ * 目录臂的计数恰好就是 core 形状规则的缺口读数;名单型旋钮臂只记前两臂都漏下的(今天 = 不在服务目录里的 `BAKE_ENV_ALLOW`)。
+ * 各腿不直接调它 —— 经 {@link hostSubprocessEnv}(剥 + 放回 + 留痕一只口)。
  */
 export declare function scrubServerSecrets(env: NodeJS.ProcessEnv, findings: ServerSecretEnvFinding[]): NodeJS.ProcessEnv;
+/**
+ * 🔴 **宿主子进程 env 的唯一组合**(S-684 残余按类收口,7.103.0):{@link scrubServerSecrets}(process.env) ∪ `allow` 点到的键
+ * (经 {@link allowlistedEnv} 从原 env 原样放回),**最终没进子进程**的剥除键经 `site` 留痕(点名放回的键不是剥除,不计数、不披露)。
+ *
+ * 六条宿主腿都只经它(直接或经 {@link gitSubprocessEnv}):host shell 缺省 scrub 腿、project-memory / center-plugins / leader 三条 git 腿、
+ * 本地语言服务器、bake-runner 的每一只子进程组。`allow` 只在**有部署级出路**的现场非空(今天 = `LSP_ENV_ALLOW` / `BAKE_ENV_ALLOW`,
+ * 它们的现场在 `SECRET_ENV_SCRUB_SITES` 里登记了 `remedy`,披露行因此是 warn + 放行名单 + 出路句);其余现场传 `[]`。
+ * 返回 `NodeJS.ProcessEnv` 形(值可能是 `undefined` 的键本来就不会进子进程);调用方显式要交的键(`LC_ALL`、`cfg.env` …)叠在它之上。
+ * 调用时机 = 每次要交 env 时现算一次(`process.env` 在本仓是 boot 期输入,各次同值;计数因此是「每组合一次」)。
+ *
+ * 🔴 **组不变量(codex r1 C1 [high])**:逐键剥除不许把一组**按组生效**的 env 剥成残组。今天的实例是 git 的 env 配置组
+ * (`GIT_CONFIG_COUNT` + `GIT_CONFIG_KEY_<i>` / `GIT_CONFIG_VALUE_<i>`):core 剥掉某个 `GIT_CONFIG_KEY_<i>`、COUNT 与 VALUE 照留 ⇒ 子进程里的
+ * git 起手就 `missing config key`、退 128(任何读配置的子命令,不只要用那条配置的)。core ≤7.33.0 形状规则的 `KEY(_<数字>)?` 后缀剥**每一个**
+ * `GIT_CONFIG_KEY_<i>`;core 7.33.1 #1129 起该族具名豁免,残组今天从**两侧**来:KEY 侧的值筛(值里是带 userinfo 的 URL —— 令牌
+ * `url.<base>.insteadOf`)剥 KEY;core 7.33.2 起 VALUE 侧的值族表(`GIT_CONFIG_VALUE_<i>` 是 `Authorization:` / `Proxy-Authorization:` /
+ * `Cookie:` 头、带 userinfo 的 URL,或 proxy 地址键下的 `user[:secret]@host` ⇒ `family-rule`)剥 VALUE。两侧的 URL userinfo 判据自 core 7.33.2
+ * 起就是**同一只**(7.33.2 = 正则 `URL_USERINFO_RE`:`//` 到 `@` 之间无 `/` `?` `#`);core 7.33.3 #1140 只改这一只判据本身,剥得更多(`://` 后到
+ * 第一个 `@` 的段:无 `/` `?` `#`,或第一个 `/` `?` `#` 之前有 `:`(段首 `[…]` 里的 `:` 不计)—— 密码里未转义的 `/` 也算;带端口的路径 `@` 过剥,
+ * core KL-1129b);core 7.33.4 #1146 再改它、不再解析 authority:值里有 `:/`、其后任意位置有 `@` 或 `%40` 即剥,proxy 地址键下值里有 `@` / `%40` 即剥
+ * —— 路径里的 `@`(`@scope` 包路径)与 scp 绝对路径带 `@`(`host:/repo@v2.git`)一并多剥(fail-closed,KL-1129b)。本不变量对哪一侧剥残的组都照样
+ * 成立(车OR / 车PA / 车PB / 车PC 提货翻钉,零改码)。
+ * 规则:交出去的组要么**源里有的成员一个不少**、要么**整组都不给**(值同扣 —— VALUE 里可能正是鉴权头);随组扣下的成员记
+ * `kind: "git-config-group"`。本层只**多扣**、从不放回 core 判掉的键(core 的判据不在这里改;`GIT_CONFIG_KEY_<i>` 是不是凭据是 core
+ * 形状规则的事,见 [ref] 登记);部署方点名放回全部 `GIT_CONFIG_KEY_<i>` 与 `GIT_CONFIG_VALUE_<i>`(有放行面的现场;core 7.33.2 起两边都可能被剥,
+ * 只放回 KEY 仍是残组)⇒ 组完整,原样交出。源里本就残缺的组不是本层
+ * 剥残的,不碰(git 对它照样报错 —— 那是部署方自己的配置)。
+ */
+export declare function hostSubprocessEnv(o: {
+    site: SecretEnvScrubSite;
+    allow: readonly string[];
+}): NodeJS.ProcessEnv;
+/** git 子进程腿的现场(闭集里名字带 `.git-` 的那几只 —— 编译期筛;它们都没有点名放行面)。 */
+export type GitSubprocessSite = Extract<SecretEnvScrubSite, `${string}.git-${string}`>;
+/**
+ * 宿主 **git 子进程**的 env:{@link hostSubprocessEnv}(site, 不放回) + `GIT_TERMINAL_PROMPT=0`(恒:凭据缺席 ⇒ 响亮失败,绝不挂在交互
+ * prompt 上 —— 服务进程没有终端)+(`isolateConfig` ⇒ `GIT_CONFIG_GLOBAL` / `GIT_CONFIG_SYSTEM` = `/dev/null`:宿主全局 / 系统 git 配置
+ * (insteadOf / credential helper / hooksPath / fsmonitor …)一概不继承)。
+ *
+ * `isolateConfig` 按腿定(三条腿各自的理由在调用点):project-memory 与 center-plugins 隔离(读仓 / 克隆不需要宿主身份);leader 推送
+ * **不**隔离 —— durable remote 的写凭据属于控制面宿主(「Coordinator's creds」),可能由宿主 git 配置里的 credential helper / insteadOf
+ * 提供,隔离会把它们一起切掉。不隔离 ≠ 不剥:helper 同样只看得到剥后的 env(读 `*_TOKEN` 形 env 的 helper 因此读不到,出路见 CHANGELOG)。
+ *
+ * ⚠️ 已知边界(不在本函数修):Apple Git 另有一层 Xcode 自带配置(`…/Xcode.app/…/git-core/gitconfig`,内含 `credential.helper=osxkeychain`),
+ * `GIT_CONFIG_SYSTEM` 盖不住、`GIT_CONFIG_NOSYSTEM=1` 才盖得住 —— 只在 macOS 开发机上,文件属 root(不可被模型种),见 [ref] 登记。
+ */
+export declare function gitSubprocessEnv(o: {
+    site: GitSubprocessSite;
+    isolateConfig: boolean;
+}): NodeJS.ProcessEnv;
 /**
  * S-699 —— **点名放行**的唯一谓词:从 `env` 里把 `names` 点到的键**原样**取出(值逐字,空串照带;源里没有的名不产生
  * 条目)。密钥形的键点到了也照取 —— 点名即部署方显式承担;要不要在这之上再叠别的基底,是调用方的事(见文件头「点名放行」节)。

package/dist/server-secret-env.js

@@ -1,5 +1,7 @@
 import { scrubSecretEnv } from "@sema-agent/core";
 import { CONFIG_CATALOG } from "./config-catalog.js";
+import { ENV_NAME_ALLOWLIST_KNOB_NAMES } from "./env-name-allowlist-knobs.js";
+import { recordSecretEnvScrub } from "./observability/secret-env-scrub.js";
 export const CATALOG_SECRET_ENV_NAMES = new Set(CONFIG_CATALOG.filter((spec) => spec.type === "secret").map((spec) => spec.name.toUpperCase()));
 export function scrubServerSecrets(env, findings) {
     const shapeFindings = [];
@@ -7,14 +9,48 @@ export function scrubServerSecrets(env, findings) {
     findings.push(...shapeFindings);
     const out = {};
     for (const key of Object.keys(shaped)) {
-        if (CATALOG_SECRET_ENV_NAMES.has(key.toUpperCase())) {
+        const upper = key.toUpperCase();
+        if (CATALOG_SECRET_ENV_NAMES.has(upper)) {
             findings.push({ key, kind: "config-catalog", confidence: "high", source: "server-config-catalog" });
             continue;
         }
+        if (ENV_NAME_ALLOWLIST_KNOB_NAMES.has(upper)) {
+            findings.push({ key, kind: "name-list-knob", confidence: "high", source: "server-name-list-knob" });
+            continue;
+        }
         out[key] = shaped[key];
     }
     return out;
 }
+export function hostSubprocessEnv(o) {
+    const scrubFindings = [];
+    const composed = { ...scrubServerSecrets(process.env, scrubFindings), ...allowlistedEnv(o.allow, process.env) };
+    const stripped = scrubFindings.filter((f) => composed[f.key] === undefined);
+    const grouped = withholdBrokenGitConfigGroup(process.env, composed).map((key) => ({ key, kind: "git-config-group", confidence: "high", source: "server-git-config-group" }));
+    recordSecretEnvScrub(o.site, [...stripped, ...grouped], o.allow);
+    return composed;
+}
+const GIT_CONFIG_GROUP_MEMBER_RE = /^GIT_CONFIG_(?:COUNT|(?:KEY|VALUE)_\d+)$/;
+function withholdBrokenGitConfigGroup(source, composed) {
+    const isMember = (k) => GIT_CONFIG_GROUP_MEMBER_RE.test(k.toUpperCase());
+    const sourceMembers = new Set(Object.keys(source).filter(isMember).map((k) => k.toUpperCase()));
+    if (!sourceMembers.has("GIT_CONFIG_COUNT"))
+        return [];
+    const composedMembers = Object.keys(composed).filter(isMember);
+    const present = new Set(composedMembers.map((k) => k.toUpperCase()));
+    if ([...sourceMembers].every((m) => present.has(m)))
+        return [];
+    for (const k of composedMembers)
+        delete composed[k];
+    return composedMembers;
+}
+export function gitSubprocessEnv(o) {
+    return {
+        ...hostSubprocessEnv({ site: o.site, allow: [] }),
+        GIT_TERMINAL_PROMPT: "0",
+        ...(o.isolateConfig ? { GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_SYSTEM: "/dev/null" } : {}),
+    };
+}
 export function allowlistedEnv(names, env) {
     const out = {};
     for (const name of names) {

package/dist/tool-approval.d.ts

@@ -1,6 +1,6 @@
 import type { HostDecidedBy, HostSettledBy } from "./host-decision.js";
 import type { IncomingMessage } from "node:http";
-import { type AskRequest, type AskOutcome, type CheckpointGate, type PendingAction, type ReadRootGrantCandidate, type RuleOffer } from "@sema-agent/core";
+import { type AskRequest, type AskOutcome, type CheckpointGate, type PendingAction, type PersistedRuleMandate, type ReadRootGrantCandidate, type RuleOffer } from "@sema-agent/core";
 import { type CardRulePersisted, type RuleConsentLane } from "./rules-consent.js";
 import { type DenialLimitFallback, type RuleOffersAbsence, type ApprovalRequestFrame, type ApprovalRevokeFrame, type RuleEvidenceProjection } from "./approval-card.js";
 import { type ApprovalAskStore, type AskRow } from "./plugins/approval-ask-store-sql.js";
@@ -244,6 +244,16 @@ export interface ToolApprovalFrame {
      * 席照常答得了」说的是**这一次调用的应答者**,本仓不改它。
      */
     mandated?: true;
+    /**
+     * **S-721(core 7.32.0 #1092;ADDITIVE,`"tool_approval"` only)** —— 强制位**站在哪一个词上**:core `PERSISTED_RULE_MANDATES`
+     * 六词之一(`operator_always` / `tool_marks` / `probe_mandate` / `probe_unanswered` / `write_protection` /
+     * `write_protection_unresolved`,词义属主在 core)。只在 `mandated: true` 的**整因**是那一个词时在场;另一扇门(治理 / hook /
+     * 祖先)或不止一个理由 ⇒ 缺席 —— **缺席从不命名一个词**,也不等于「不强制」(读 `mandated`)。值经 `approval-card.ts` 的
+     * `readClosedWordSeat(req, "mandate")` 窄读(闭集筛 = core `isPersistedRuleMandate`,本仓不抄词表;集外词读作缺席 + 计一次)。echo-only:
+     * 本仓不按词分支。耐久面同一个词:运维队列行(`parkRowFacts`,park 行孪生座)与 inbox 行(core `CheckpointSummary.mandate`)。
+     * 与 `mandated` 同一条:`card_json` 卡面不带本键(`ApprovalCardSchema` `.strict()`)。
+     */
+    mandate?: PersistedRuleMandate;
     /**
      * **S-125③/[ref]**(core 7.5.0;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**出身**:
      * 谁提的这一问,一个 core 闭集词(`ASK_ORIGINS` **11 员**,core 7.14.0 现值:content_question /
@@ -263,6 +273,12 @@ export interface ToolApprovalFrame {
      * 🔴 **不枚举词表**(`string` 而不是本仓自铸的联合):词表单一属主在 core,在这里抄一份会把 core 加的
      * 新词吞成缺席 —— 与 `wiring_manifest.autoMode.reason` 的透传纪律逐字同规。缺席 = 老引擎 / 非 ask 路径。
      *
+     * 同一个词的其余四面(S-755 起全部在场):`livePending` 行顶层 / `live_pending` 帧(条目铸定时与本键**同一次**读定);运维队列行
+     * (`GET /v1/approvals` 的 `pending[]` + `/stream` 的 `pending` 帧,读 park 行孪生座 `PendingAction.tool_approval.origin`,经
+     * `approval-card.ts` 的 `readClosedWordSeat(…, "origin")` —— 那一面读的是持久层原字节、中间没有 core 投影,所以亲手调 core 的
+     * `isAskOrigin`);inbox 行(core `CheckpointSummary.origin`,core 投影处已筛)。本键读的是引擎在门上刚盖好的值(盖章点即 core
+     * 的筛点),所以只过「非空串」形门、不再筛第二遍 —— 对 core 盖得出的每一个词,五面逐字同值。
+     *
      * ⚠️ 与 {@link governanceForced} **不是**一回事,别互相顶替:本键答「哪一类权威提的问」,那一键答
      * 「**本部署运维治理层**是不是这只 ask 的门」。`origin: "policy"` 覆盖的是「任何部署 ToolPolicy 的
      * ask」,治理策略产的与普通策略产的在这一个词上同形 ⇒ 顶替不了(逐字论证见 `governance-ask-marks.ts` 顶注)。
@@ -530,6 +546,13 @@ export interface LivePendingRow {
      *  值 = 条目上那一位(`askBroadcast` 铸条目时取自这一次过闸的 `req.mandated`,与 {@link frame} 上的同名键同源)。此前只在
      *  `frame` 里:同一个 `GET /v1/approvals` 响应的 durable `pending[]` 行顶层带它(S-663 二段),live 行却要进帧里读。 */
     mandated?: true;
+    /** S-721(core 7.32.0 #1092):强制位站在哪一个词上 —— 与 `mandated` 同层同形(在场逐字,缺席不编词),值 = 条目上那一个词
+     *  (与 {@link frame} 上同名键同源;帧型该键顶注是全文)。 */
+    mandate?: PersistedRuleMandate;
+    /** S-755(cli L-695 / [ref]):ask 的**出身词**(谁提的这一问,core `ASK_ORIGINS` 闭集一词)—— 与 `mandate` 同层同形(在场逐字,
+     *  缺席不编词),值 = 条目上那一个词(铸条目那一次与 {@link frame} 上同名键**同一次**读定;帧型该键顶注是全文)。同一个
+     *  `GET /v1/approvals` 响应里 durable `pending[]` 行的 `origin` 也在顶层(park 行孪生座),两族行同一种读法。 */
+    origin?: string;
     /** 发起者为委派子代(originTaskId 在场)。 */
     fromSubagent?: true;
     /** [ref] C2(additive):委派子代的 **canonical taskId**。值域精确成文(codex R1-F3 问询后按 core dist
@@ -695,6 +718,11 @@ export declare const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOffe
  */
 export declare const SETTLED_BY_MUST_BE_STRING = "settledBy must be a string \u2014 the settlement source is one word from the engine's closed set, and this layer judges only the SHAPE (which word it is, the engine decides)";
 export declare const SETTLED_BY_DENY_ONLY = "settledBy is only meaningful with decision \"deny\" \u2014 only a person approves an action that EXECUTES, so a self-reported settlement source on an allow is a contradiction the engine refuses; the refusal would arrive too late to undo this door's own side effects (a session allow-all grant, a persisted rule, a DECIDED row that replays as a plain approval), so it is refused here, before the decision";
+/** S-720(core 7.32.0 #1093)—— `readRootGrant` 只随 `decision:"allow"`(CC 卡的第三选项「Yes, and add directory」= 放行这一次
+ *  + 加目录;`allow_session` 不是那一个选项,`deny` 上它没有意义)。裁决之前响亮拒,不静默丢。 */
+export declare const READ_ROOT_GRANT_ALLOW_ONLY = "readRootGrant is only meaningful with decision \"allow\" \u2014 it is the card's \"Yes, and add directory\" answer (allow this call and add the card's readRootCandidate.dir to this run's read directories)";
+/** S-720:`readRootGrant` 的形 —— 卡上 `readRootCandidate.dir` 的原串(非空,≤ core `READ_ROOT_CANDIDATE_DIR_MAX`;超限整只拒,不截:截过的目录是另一个目录)。 */
+export declare const READ_ROOT_GRANT_SHAPE = "readRootGrant must be the card's readRootCandidate.dir sent back byte for byte \u2014 a non-empty string of at most 1024 characters";
 export declare const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope \u2014 the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
 /** Validate the respond body — the closed three-choice enum (rationale in the module header). */
 export declare function parseToolApprovalResponse(body: unknown): {
@@ -704,6 +732,7 @@ export declare function parseToolApprovalResponse(body: unknown): {
     persistRule?: ParsedPersistRule;
     note?: string;
     settledBy?: string;
+    readRootGrant?: string;
 } | {
     ok: false;
     error: string;

package/dist/tool-approval.js

@@ -1,6 +1,6 @@
 import { contentKindOf } from "./approval-content-kind.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, MAX_RULE_TEXT_CHARS, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
+import { uuidv7, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
 import { redactDeep, redactSecrets, redactSecretsWithArms } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -8,7 +8,7 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
@@ -111,6 +111,8 @@ function respondSettledBy(parsed) {
     return parsed.settledBy;
 }
 export const SETTLED_BY_DENY_ONLY = 'settledBy is only meaningful with decision "deny" — only a person approves an action that EXECUTES, so a self-reported settlement source on an allow is a contradiction the engine refuses; the refusal would arrive too late to undo this door\'s own side effects (a session allow-all grant, a persisted rule, a DECIDED row that replays as a plain approval), so it is refused here, before the decision';
+export const READ_ROOT_GRANT_ALLOW_ONLY = 'readRootGrant is only meaningful with decision "allow" — it is the card\'s "Yes, and add directory" answer (allow this call and add the card\'s readRootCandidate.dir to this run\'s read directories)';
+export const READ_ROOT_GRANT_SHAPE = `readRootGrant must be the card's readRootCandidate.dir sent back byte for byte — a non-empty string of at most ${READ_ROOT_CANDIDATE_DIR_MAX} characters`;
 export const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope — the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
 export function parseToolApprovalResponse(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
@@ -161,6 +163,12 @@ export function parseToolApprovalResponse(body) {
         if (rawSettledBy !== undefined && typeof rawSettledBy !== "string")
             return { ok: false, error: SETTLED_BY_MUST_BE_STRING };
         const settledBy = rawSettledBy;
+        const rawGrant = body.readRootGrant;
+        if (rawGrant !== undefined && d !== "allow")
+            return { ok: false, error: READ_ROOT_GRANT_ALLOW_ONLY };
+        if (rawGrant !== undefined && (typeof rawGrant !== "string" || rawGrant === "" || rawGrant.length > READ_ROOT_CANDIDATE_DIR_MAX))
+            return { ok: false, error: READ_ROOT_GRANT_SHAPE };
+        const readRootGrant = rawGrant;
         return {
             ok: true,
             value: d,
@@ -168,6 +176,7 @@ export function parseToolApprovalResponse(body) {
             ...(persistRule !== undefined ? { persistRule } : {}),
             ...(note !== undefined ? { note } : {}),
             ...(rawSettledBy !== undefined ? { settledBy } : {}),
+            ...(readRootGrant !== undefined ? { readRootGrant } : {}),
         };
     }
     return { ok: false, error: 'decision must be one of "allow" | "allow_session" | "deny"' };
@@ -938,6 +947,8 @@ export class ToolApprovalCoordinator {
         const bounded = boundArgs(req.args);
         let effectiveGovernanceForced = governanceForced;
         let ruleLaneMaterial = this.buildRuleLaneMaterial(req, origin.owner, governanceForced, origin.sessionId);
+        const mandateWord = readClosedWordSeat(req, "mandate");
+        const originWord = typeof req.origin === "string" && req.origin.length > 0 ? req.origin : undefined;
         const frame = {
             type: "tool_approval",
             approvalId: id,
@@ -963,7 +974,8 @@ export class ToolApprovalCoordinator {
             ...(governanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(req.mandated === true ? { mandated: true } : {}),
-            ...(typeof req.origin === "string" && req.origin.length > 0 ? { origin: req.origin } : {}),
+            ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
+            ...(originWord !== undefined ? { origin: originWord } : {}),
             ...(typeof req.persistedRuleShadowed === "string" && req.persistedRuleShadowed !== ""
                 ? { persistedRuleShadowed: redactSecrets(req.persistedRuleShadowed).slice(0, MAX_RULE_TEXT_CHARS) }
                 : {}),
@@ -1170,11 +1182,17 @@ export class ToolApprovalCoordinator {
                 return unattended === "unavailable" ? unattended : shapeDeny(unattended);
             }
             if (settled.allowed) {
-                return settled.updatedInput !== undefined ? { allow: true, updatedInput: settled.updatedInput } : true;
+                if (settled.updatedInput === undefined && settled.readRootGrant === undefined)
+                    return true;
+                return {
+                    allow: true,
+                    ...(settled.updatedInput !== undefined ? { updatedInput: settled.updatedInput } : {}),
+                    ...(settled.readRootGrant !== undefined ? { readRootGrant: settled.readRootGrant } : {}),
+                };
             }
             return shapeDeny(false);
         };
-        const settle = (allowed, outcome, updatedInput, hostSettledBy, denyReason) => {
+        const settle = (allowed, outcome, updatedInput, hostSettledBy, denyReason, readRootGrant) => {
             if (done)
                 return;
             done = true;
@@ -1208,7 +1226,7 @@ export class ToolApprovalCoordinator {
                 ...(hostSettledBy !== undefined ? { settledBy: hostSettledBy } : {}),
                 settledAtMs: Date.now(),
             });
-            resolveAllowed({ allowed, ...(allowed && updatedInput !== undefined ? { updatedInput } : {}) });
+            resolveAllowed({ allowed, ...(allowed && updatedInput !== undefined ? { updatedInput } : {}), ...(allowed && readRootGrant !== undefined ? { readRootGrant } : {}) });
         };
         const broadcastClaimTruth = (read) => {
             if (askId === undefined)
@@ -1483,6 +1501,8 @@ export class ToolApprovalCoordinator {
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(req.mandated === true ? { mandated: true } : {}),
+            ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
+            ...(originWord !== undefined ? { origin: originWord } : {}),
             ...(askId !== undefined && batchId !== undefined ? { askId, batchId } : {}),
         };
         selfEntry = pendingEntry;
@@ -2051,7 +2071,7 @@ export class ToolApprovalCoordinator {
             approvalPayloadFingerprint({ updatedInput: ambiguousConfirmedRow.updatedInput }) === approvalPayloadFingerprint({ updatedInput: parsed.updatedInput });
         const result = this.finishRespond(id, entry, parsed, {
             noteRecorded: noteLanded,
-            ...(winnerRow !== undefined ? { settleOutcome: outcomeOfDecidedRow(winnerRow) } : {}),
+            ...(winnerRow !== undefined ? { settleOutcome: outcomeOfDecidedRow(winnerRow), settleOutcomeIsThisRequest: ambiguousConfirmedRow === undefined } : {}),
             ...(ambiguousConfirmedRow !== undefined ? { updatedInputDelivered: payloadIsMine } : {}),
         });
         if (winnerRow !== undefined)
@@ -2077,7 +2097,8 @@ export class ToolApprovalCoordinator {
         }
         const allowed = parsed.value !== "deny";
         const settleArgs = opts?.settleOutcome !== undefined ? settleArgsOfDecided(opts.settleOutcome) : { allowed, updatedInput: parsed.updatedInput, settledBy: respondSettledBy(parsed) };
-        entry.settle(settleArgs.allowed, settleArgs.allowed ? "allowed" : "denied", settleArgs.updatedInput, settleArgs.settledBy, settleArgs.allowed ? undefined : parsed.note);
+        const readRootGrant = opts?.settleOutcome === undefined || opts.settleOutcomeIsThisRequest === true ? parsed.readRootGrant : undefined;
+        entry.settle(settleArgs.allowed, settleArgs.allowed ? "allowed" : "denied", settleArgs.updatedInput, settleArgs.settledBy, settleArgs.allowed ? undefined : parsed.note, readRootGrant);
         const updatedInputDelivered = opts?.updatedInputDelivered ?? true;
         const noteRecorded = opts?.noteRecorded ?? false;
         return {
@@ -2107,6 +2128,8 @@ export class ToolApprovalCoordinator {
                 ...(e.requiresRealApproval ? { requiresRealApproval: true } : {}),
                 ...(e.governanceForced ? { governanceForced: true } : {}),
                 ...(e.mandated ? { mandated: true } : {}),
+                ...(e.mandate !== undefined ? { mandate: e.mandate } : {}),
+                ...(e.origin !== undefined ? { origin: e.origin } : {}),
                 ...(e.originTaskId !== undefined ? { fromSubagent: true, originTaskId: e.originTaskId } : {}),
                 ...(contentKind !== undefined ? { contentKind } : {}),
                 frame: e.frame.approvalId === id ? e.frame : { ...e.frame, approvalId: id },

package/dist/trace/core-keyset-guard.d.ts

@@ -43,7 +43,7 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable" | "readRootCandidate" | "mandated";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable" | "readRootCandidate" | "mandated" | "mandate";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
@@ -59,7 +59,7 @@ type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
-type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "writeProtection" | "teamRole";
+type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "hands" | "writeProtection" | "teamRole";
 type WiringSectionExcluded = "governance" | "configFingerprint" | "autoConsolidation" | "readDeny" | "peerPresence" | "fileHistory";
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
@@ -104,6 +104,9 @@ type _GuardWiringMcpLivenessReverse = AssertAllKeysHandled<Exclude<WiringMcpLive
 type WiringRulesHandled = "storeWired" | "syncWired" | "orgGoverned";
 type _GuardWiringRules = AssertAllKeysHandled<Exclude<keyof WiringSection<"permissionRules">, WiringRulesHandled>>;
 type _GuardWiringRulesReverse = AssertAllKeysHandled<Exclude<WiringRulesHandled, keyof WiringSection<"permissionRules">>>;
+type WiringHandsHandled = "mounted" | "reason";
+type _GuardWiringHands = AssertAllKeysHandled<Exclude<keyof WiringSection<"hands">, WiringHandsHandled>>;
+type _GuardWiringHandsReverse = AssertAllKeysHandled<Exclude<WiringHandsHandled, keyof WiringSection<"hands">>>;
 type WiringWriteProtectionHandled = "targetView";
 type _GuardWiringWriteProtection = AssertAllKeysHandled<Exclude<keyof WiringSection<"writeProtection">, WiringWriteProtectionHandled>>;
 type _GuardWiringWriteProtectionReverse = AssertAllKeysHandled<Exclude<WiringWriteProtectionHandled, keyof WiringSection<"writeProtection">>>;
@@ -130,7 +133,7 @@ type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTrace
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable" | "mandated";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable" | "mandated" | "mandate";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
@@ -138,7 +141,7 @@ type ParkArmKeys = keyof Extract<PendingAction, {
     kind: "tool_approval";
 }>;
 type ParkArmQueueProjected = "toolName" | "toolCallId" | "boundInputHash" | "ruleOffers" | "hasBidiControls" | keyof import("../approval-card.js").ParkRowFacts;
-type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable";
+type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "ruleStoreUnreadable";
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
@@ -236,6 +239,8 @@ export type CoreKeysetGuards = [
     _GuardWiringSections,
     _GuardWiringWriteProtection,
     _GuardWiringWriteProtectionReverse,
+    _GuardWiringHands,
+    _GuardWiringHandsReverse,
     _GuardWiringReadDeny,
     _GuardWiringReadDenyReverse,
     _GuardWiringAutoConsolidation,