@sema-agent/server 7.109.0 → 7.110.0

package/dist/run-local.js

@@ -10,6 +10,7 @@ import { fileURLToPath } from "node:url";
 import { Runner, uuidv7, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
 import { singleUserAutoAcceptBaselineApplies } from "./approval.js";
 import { withUnattendedLeg } from "./unattended-permission-mode.js";
+import { buildUnattendedPolicyRefusal } from "./tool-approval.js";
 import { createBrain } from "./brain.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "./deployment-governance.js";
 import { applyRuntimeGovernance } from "./runtime-governance.js";
@@ -130,8 +131,14 @@ const RUN_LOCAL_APPROVAL_SEAT = { kind: "live" };
 export function applyLocalGovernance(base, config, workspaceDir, engineDataRoot) {
     return applyRuntimeGovernance({ ...base, toolPolicy: createApprovalBaselinePolicy(config, RUN_LOCAL_APPROVAL_SEAT) }, createDeploymentGovernanceInputs(config, { env: new NodeExecutionEnv({ cwd: workspaceDir }), cwd: workspaceDir }, { engineDataRoot }));
 }
+const NO_TTY_REFUSAL_REASON = "this run-local invocation has no TTY, so there is no one to put this approval to; it is refused fail-closed instead of being asked.";
+const UNDISPLAYABLE_ARGS_REFUSAL_REASON = "the call's arguments cannot be displayed, so there is nothing a person could review; it is refused fail-closed instead of being asked.";
 export function createLocalApprover(io) {
     let tail = Promise.resolve();
+    const refuseWithoutPerson = (reason) => {
+        io.noteRefusedWithoutPerson();
+        return buildUnattendedPolicyRefusal(reason);
+    };
     return async (req, signal) => {
         if (!io.isTty) {
             io.printErr(`denied "${terminalSafeText(req.toolName)}" (${terminalSafeText(req.message)}) — this run-local invocation has no TTY, so there is nobody to ask. ` +
@@ -139,13 +146,13 @@ export function createLocalApprover(io) {
                 `APPROVAL_DENY refuses outright without asking), AUTONOMY, MANUAL_MODE_SHELL_GATE, runtime.commandPolicy (config.d/governance.json). ` +
                 `Run it in a terminal to answer interactively, or relax the knob (APPROVAL_AUTO_BUDGET auto-approves that many APPROVAL_REQUIRE calls; ` +
                 `a separate .env for this CLI keeps a server's lists off it).`);
-            return false;
+            return refuseWithoutPerson(NO_TTY_REFUSAL_REASON);
         }
         const argsShown = argsDisplayOf(req.args);
         if (!argsShown.ok) {
             io.printErr(`denied "${terminalSafeText(req.toolName)}" (${terminalSafeText(req.message)}) — its arguments cannot be displayed ` +
                 `(${terminalSafeText(argsShown.reason)}), so there is nothing a person could review; refusing instead of asking.`);
-            return false;
+            return refuseWithoutPerson(UNDISPLAYABLE_ARGS_REFUSAL_REASON);
         }
         const prior = tail;
         let release;
@@ -221,24 +228,28 @@ export async function promptYesNoOnTty(prompt, signal, streams = { input: proces
         rl.close();
     }
 }
-function personStopOf(result) {
+function unfinishedStopOf(result, refusedWithoutPerson) {
     if (result.terminal.kind !== "completed")
         return undefined;
     if (result.haltedOnUserRejection === true)
         return "haltedOnUserRejection";
     if (result.haltedByUser === true)
         return "haltedByUser";
+    if (refusedWithoutPerson > 0)
+        return "approvalUnanswered";
     return undefined;
 }
-function buildPersonStopFooter(stop, sessionId) {
+function buildUnfinishedStopFooter(stop, sessionId) {
     switch (stop) {
         case "haltedOnUserRejection":
             return `task stopped (haltedOnUserRejection): a tool call was refused, so the run did not finish its work — continue it with --session ${sessionId}`;
         case "haltedByUser":
             return `task stopped (haltedByUser): the run was halted before it finished its work — continue it with --session ${sessionId}`;
+        case "approvalUnanswered":
+            return `task incomplete (approval unanswered): a tool call needed an approval that no person could give in this invocation (see the "denied" lines above), so the run did not finish its work — continue it with --session ${sessionId}`;
         default: {
             const unhandled = stop;
-            throw new Error(`person-stop marker "${String(unhandled)}" has no footer`);
+            throw new Error(`unfinished-stop word "${String(unhandled)}" has no footer`);
         }
     }
 }
@@ -421,10 +432,14 @@ export async function runLocal(argv, deps = {}) {
     catch (e) {
         logger.warn("center_prompts_catalog_restore_failed", { err: String(e), note: "catalog candidate absent — built-ins serve" });
     }
+    let refusedWithoutPerson = 0;
     const onAsk = createLocalApprover({
         isTty: deps.isTty ?? process.stdin.isTTY === true,
         askYesNo: deps.askYesNo ?? promptYesNoOnTty,
         printErr,
+        noteRefusedWithoutPerson: () => {
+            refusedWithoutPerson++;
+        },
     });
     const engineOnError = (err, ctx) => {
         if (ctx.phase === "memory") {
@@ -622,14 +637,14 @@ export async function runLocal(argv, deps = {}) {
         await fileBackend.dispose();
         return 1;
     }
-    const personStop = personStopOf(result);
+    const unfinishedStop = unfinishedStopOf(result, refusedWithoutPerson);
     if (args.json) {
         print(JSON.stringify(result, null, 2));
     }
     else if (result.terminal.kind === "completed") {
         print(result.result);
-        if (personStop !== undefined)
-            printErr(buildPersonStopFooter(personStop, sessionId));
+        if (unfinishedStop !== undefined)
+            printErr(buildUnfinishedStopFooter(unfinishedStop, sessionId));
     }
     else {
         const plane = outwardPlane(result.terminal);
@@ -638,7 +653,7 @@ export async function runLocal(argv, deps = {}) {
             print(salvage);
         printErr(`task ${plane.status}${plane.errorCode ? ` (${plane.errorCode})` : ""}${plane.errorMessage ? `: ${plane.errorMessage}` : ""}`);
     }
-    if (result.terminal.kind !== "completed" || personStop !== undefined)
+    if (result.terminal.kind !== "completed" || unfinishedStop !== undefined)
         exitCode = 1;
     if (memorySync) {
         try {

package/dist/runs.d.ts

@@ -9,6 +9,7 @@ import { type ToolApprovalCoordinator } from "./tool-approval.js";
 import { type FleetRunPublisher } from "./fleet/fleet-bus.js";
 import { type WorkflowCompletionInbox } from "./orchestration/workflow-completion-inbox.js";
 import type { VerifyRoundsSpec } from "./http/verify-rounds.js";
+import type { UserInputLedger } from "./user-input-ledger.js";
 /**
  * stoppedBy (core 1.252): a service cancel is a USER stop — mark the run's still-running background
  * children BEFORE core's teardown reaps them (bare abort = attribution falls back to "system"; core's own
@@ -368,7 +369,13 @@ pendingEngineNotices?: readonly {
  * `TrustedRunInternals` 的白名单会在编译期先红一次(它只开部署方可以决定的那一格)。
  * 缺席 ⇒ 座席与本位存在之前逐字相同。
  */
-trustedInternals?: Pick<RunInternals, "workflowParkedResume">): Promise<void>;
+trustedInternals?: Pick<RunInternals, "workflowParkedResume">, 
+/**
+ * S-928 用户输入受理账本(`src/user-input-ledger.ts`;路由层 `deps.userInputLedger`)。两手:开通告口那一拍(模型调用之前)把本会话
+ * 已收敛、未告知的崩溃丢失铸成 `task.user_steer_undrained{cause:"crashed"}`;腿收场时把本腿上的 steer 受理 settle 掉。
+ * 缺席 ⇒ 两手都不做(与本参数存在之前逐字相同)。
+ */
+userInputLedger?: UserInputLedger): Promise<void>;
 /** How often a running instance refreshes its run's updated_at (liveness, independent of events).
  *  Must stay strictly below `runStaleSec` (asserted at startup AND on every hot config candidate) or the
  *  reaper would race live runs. [ref]:数值的单源是 `config-invariants.ts`(那条不变量的属主),两个消费面

package/dist/runs.js

@@ -173,7 +173,7 @@ export function evictIfConflict(runner, sessionId, result) {
         runner.sessions.evict?.(sessionId);
     }
 }
-export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices, trustedInternals) {
+export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices, trustedInternals, userInputLedger) {
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart();
@@ -270,9 +270,11 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     const unregisterEngineNotice = registerEngineNoticeLeg({
         sessionId: spec.sessionId,
         ...(pendingEngineNotices !== undefined ? { pending: pendingEngineNotices } : {}),
-        durable: (row) => void append("engine_notice", row).catch(() => recordFailOpen("server.engine-notice.durable-append-failed", `leg=bg code=${row.code} task=${taskId}`)),
+        durable: (row) => append("engine_notice", row).then(() => true, () => (recordFailOpen("server.engine-notice.durable-append-failed", `leg=bg code=${row.code} task=${taskId}`), false)),
     });
     try {
+        if (userInputLedger && spec.sessionId)
+            await userInputLedger.announceUndrained({ sessionId: spec.sessionId, taskId });
         await emitPendingWorkflowCompletions(workflowCompletionInbox, spec.sessionId, elicitOwner ?? owner, (frame) => {
             const { type, ...rest } = frame;
             const f = frame;
@@ -538,6 +540,8 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                     ...(spec.sessionId ? { transcriptId: spec.sessionId } : {}),
                 });
         }
+        if (steerableStreamRef !== undefined)
+            await userInputLedger?.settleLeg(steerableStreamRef);
         if (inflight?.get(taskId) === cancelCtrl)
             inflight.delete(taskId);
         if (preemptable?.get(taskId) === preemptCtrl)

package/dist/runtime-governance.d.ts

@@ -61,11 +61,11 @@ export declare const COARSE_SHELL_TOOLS_MIRROR: readonly string[];
  *  OK). Called at config-apply (config-center/facade.ts `applyRuntimeHot`) so a malformed rule that BYPASSED the
  *  registry schema (a hand-edited config.d / a non-conformant publish) is rejected LOUDLY rather than
  *  silently mis-compiling — review MEDIUM: an out-of-enum `decision` (e.g. "DENY") would otherwise fall through
- *  {@link compileCommandPolicy}'s `decision==="deny"?…:"ask"` to ASK, silently WEAKENING an intended deny. */
+ *  {@link compileCommandPolicyLayers}'s `decision==="deny"?…:"ask"` to ASK, silently WEAKENING an intended deny. */
 export declare function validateCommandRules(rules: CommandRule[]): string[];
 /**
- * Compile `runtime.commandPolicy` (per-command 3-way rules) into a single ToolPolicy, or `undefined` when there
- * is nothing to govern. The registry model (per-command `allow`/`ask`/`deny`) and core's helper model
+ * Compile `runtime.commandPolicy` (per-command 3-way rules) into the command gate's LEAF policies (`[]` when there
+ * is nothing to govern). The registry model (per-command `allow`/`ask`/`deny`) and core's helper model
  * (`allow[]` + `deny[]` + `defaultAction`) don't map 1:1, so the compilation picks a mode by the rules present:
  *
  *  - **Allowlist mode** — triggered when ANY rule resolves to `allow`. Only `allow` commands pass; `deny` wins;
@@ -81,7 +81,12 @@ export declare function validateCommandRules(rules: CommandRule[]): string[];
  * strictest-wins (without this, the `allow` rule would shadow the `ask` for that command in allowlist mode).
  *
  * Either way the result only ever ADDS asks/denies — composed onto the baseline via `combinePolicies`
- * (deny-wins) by {@link applyRuntimeGovernance}, so it is tighten-only. (Assumes commands are pre-validated by
+ * (deny-wins) by {@link applyRuntimeGovernance}, so it is tighten-only.
+ *
+ * 🔴 **S-958:返回叶,不在这里折**(改名自 `compileCommandPolicy`,修前返回 blocklist 形里 `combinePolicies(coarseDeny, askList)` 的
+ * 一只折叠)。复合命令(`a && b`、管道、`;`)上两只叶都按「解析不了 ⇒ 问」问 ⇒ 那只折叠带出 `foldedAskClasses`,而治理层随后要给每只
+ * ask 盖部署出身 —— 盖在折叠的输出上就是展开一只 core 担保过身份的对象(core #1266 7.39.0 按名拒)。叶交出去,由
+ * {@link applyRuntimeGovernance} 逐叶盖位、折**一次**:本函数不知道出身这件事,治理层只有一个折叠点。 (Assumes commands are pre-validated by
  * {@link validateCommandRules}; an un-matchable command here is simply inert, never a parse error.)
  *
  * 🔴 **S-496:词表外的 `decision` 折 `deny`,不折 `ask`。** {@link validateCommandRules} 的头注写下的那条
@@ -91,7 +96,7 @@ export declare function validateCommandRules(rules: CommandRule[]): string[];
  * 收口:`VALID_DECISIONS` 之外的值一律折最严的 `deny`(fail-closed,[ref] 的运行期 miss 臂,下方自陈),
  * 闭集本身则由契约 zod 派生 ⇒ 契约加一个判词,`RANK` 与桶分配的穷尽 switch 双双**编译红**。
  */
-export declare function compileCommandPolicy(rules: CommandRule[] | undefined): ToolPolicy | undefined;
+export declare function compileCommandPolicyLayers(rules: CommandRule[] | undefined): ToolPolicy[];
 /**
  * Expand an autonomy mode into TIGHTEN-ONLY `TaskSpec` safety overrides (the primitives — TRAP #2):
  *  - `read-only` / `plan` → `handsReadOnly: true` **+ `writeFace: "roots"`** (read + propose, never mutate; the
@@ -216,20 +221,27 @@ export declare function governanceOriginOf(gate: {
  * 本仓的类级门是 test/operator-knob-client-posture-matrix.test.ts 的 旋钮×表态×lane 矩阵):
  * `SENSITIVE_WRITE_PATTERNS` 是 [ref] 那次搬家漏下的兄弟旋钮——同一个病灶原样复发在 sensitive-path
  * DENY 腿上(唯一合成点在 deriveSettingsPolicy 的 fsWriteGate 闭包,bypassPermissions/键缺席/settings
- * 整缺席三形整条腿不建)。同方修:调用方(resolve-spec)把 operator 守卫集预铸成 `sensitivePathPolicy`
- * 从这里**无条件施加**——它只在守卫段上产 deny(core 语义 deny/"safety"),对其余目标返回的是
+ * 整缺席三形整条腿不建)。同方修:调用方(resolve-spec)把 operator 守卫集预铸成 `sensitivePathLayers`(叶;S-958 起不再是
+ * 一只预折的策略,见下段)从这里**无条件施加**——它只在守卫段上产 deny(core 语义 deny/"safety"),对其余目标返回的是
  * `action:"allow"`(**不是**「无意见」这种第三态:core 的 ToolPolicy 没有弃权值。它在
  * `combinePolicies` 的 deny/ask 优先折叠里不构成一票,所以在**折叠语境**下等价于弃权;若日后有人把
  * 这条策略单独当成唯一 policy 用,那个 allow 就是真放行——别照抄这句话去别的语境)。于是对 bypass
  * 只挡守卫段、不给普通目标加 ask 门([ref] 表第四行「bypass=不加门非开门」保持逐字)。策略在这里
  * 只组合不构造:裁决 env 的 lane 分形(host 真 fs / 沙箱 deferred 代理)是 resolve-spec 的属主知识,
  * governance 层不重复它。
+ *
+ * 🔴 **S-958(core #1266 7.39.0)—— 治理层只有一个折叠点**:两种输入都交**叶**(`compileCommandPolicyLayers` 的那几只、
+ * `sensitivePathLayers` 的那几只),本函数对每一片叶各盖一次部署出身(`createDeploymentAuthoredPolicy`),再交 core
+ * `combinePolicies` 折一次;折叠是最外层,输出经标记观察器原物交回。修前是「先折、再在折叠输出上展开盖位」——折叠带出
+ * `foldedAskClasses` 时交给 core 的是副本,7.39.0 起按名拒(工具不跑、无卡)。
  */
 export declare function applyRuntimeGovernance(base: TaskSpec, governance: {
     autonomy?: Autonomy;
     commandPolicy?: CommandRule[];
     manualModeShellGate?: ShellGateDoctrine;
-    sensitivePathPolicy?: ToolPolicy;
+    /** 守卫集的**叶**(`deployment-governance.ts` `createDeploymentGovernanceInputs` 预铸;S-958 起是叶的列表,不是一只预折的策略)。
+     *  空列表与缺席同义。 */
+    sensitivePathLayers?: readonly ToolPolicy[];
     /** [ref]/[ref] `governanceForced` 的标记表(缺省 = **当前 run 腿的 ALS 表**,见
      *  `governance-ask-marks.ts` 顶注「作用域」段)。注入口只为测试与将来的多实例形。 */
     askMarks?: GovernanceAskMarks;

package/dist/runtime-governance.js

@@ -1,7 +1,7 @@
 import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, wrapToolPolicy, } from "@sema-agent/core";
 import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
-import { operatorAsk, withDeploymentAuthorship } from "./operator-ask.js";
+import { createDeploymentAuthoredPolicy, operatorAsk } from "./operator-ask.js";
 import { heldRuleName } from "./tool-rule-names.js";
 const COMMAND_RULE_SHAPE = GovernanceConfig.shape.commandPolicy.unwrap().element.shape;
 const COMMAND_DECISIONS = COMMAND_RULE_SHAPE.decision.options;
@@ -57,9 +57,9 @@ export function validateCommandRules(rules) {
     }
     return errors;
 }
-export function compileCommandPolicy(rules) {
+export function compileCommandPolicyLayers(rules) {
     if (!rules || rules.length === 0)
-        return undefined;
+        return [];
     const RANK = { deny: 3, ask: 2, allow: 1 };
     const strictest = new Map();
     for (const r of rules) {
@@ -98,9 +98,7 @@ export function compileCommandPolicy(rules) {
         if (ask.length > 0)
             policies.push(createCommandAskListPolicy(ask));
     }
-    if (policies.length === 0)
-        return undefined;
-    return policies.length === 1 ? policies[0] : combinePolicies(...policies);
+    return policies;
 }
 export function autonomyOverrides(autonomy) {
     switch (autonomy) {
@@ -125,7 +123,7 @@ export function governanceOriginOf(gate, governance) {
 function createGovernanceAskMarkingPolicy(inner, marksOf) {
     const note = (d, req) => {
         marksOf()?.setMarked(req.toolCallId, d.action === "ask");
-        return d.action === "ask" ? withDeploymentAuthorship(d) : d;
+        return d;
     };
     return wrapToolPolicy(inner, (req, signal) => {
         const decision = inner.check(req, signal);
@@ -145,11 +143,8 @@ function createGovernanceShellGateMarkPolicy(marksOf, tools = COARSE_SHELL_TOOLS
 export function applyRuntimeGovernance(base, governance) {
     const marksOf = () => governance.askMarks ?? currentGovernanceAskMarks();
     const overrides = { ...autonomyOverrides(governance.autonomy) };
-    const coarse = compileCommandPolicy(governance.commandPolicy);
-    const governancePolicies = [coarse, governance.sensitivePathPolicy].filter((p) => p !== undefined);
-    const governancePolicy = governancePolicies.length > 0
-        ? createGovernanceAskMarkingPolicy(governancePolicies.length === 1 ? governancePolicies[0] : combinePolicies(...governancePolicies), marksOf)
-        : undefined;
+    const layers = [...compileCommandPolicyLayers(governance.commandPolicy), ...(governance.sensitivePathLayers ?? [])];
+    const governancePolicy = layers.length > 0 ? createGovernanceAskMarkingPolicy(combinePolicies(...layers.map(createDeploymentAuthoredPolicy)), marksOf) : undefined;
     if (governancePolicy !== undefined)
         overrides.toolPolicy = governancePolicy;
     if (governance.manualModeShellGate === "always")

package/dist/session-records-skipped-notice.d.ts

@@ -1,6 +1,7 @@
-import type { FileStorageCorruptReadInfo, SessionRepo } from "@sema-agent/core";
-import { type EngineNoticeRouter, type ServerNoticeCode } from "./trace/engine-notice-wire.js";
-export declare const SESSION_RECORDS_SKIPPED: ServerNoticeCode;
+import type { EngineNoticeCode, FileStorageCorruptReadInfo, SessionRepo } from "@sema-agent/core";
+import { type EngineNoticeRouter } from "./trace/engine-notice-wire.js";
+/** 码常量型 = core 码册(#1240 入册:受众 user、铸者 `NOTICE_MINTER` = `"server"`)。 */
+export declare const SESSION_RECORDS_SKIPPED: EngineNoticeCode;
 /**
  * 披露座上的「作用域在场则记」腿(装配点 = `plugins/store-backend.ts` 里喂给 `LocalSessionStore` 的那只
  * `FileSessionRepo` 的 `onCorruptRead`)。只认 `kind:"replay"` 这一级(`record` 由它汇总,`file` 没有会话归属)。

package/dist/task-settings.d.ts

@@ -137,12 +137,6 @@ export declare function effectiveThinking(reasoningEffort: unknown, ultracode: b
  *  field is the explicit per-turn intent → it WINS over a bundle defaultMode). Creates a minimal settings object when
  *  no `body.settings` bundle was sent. The result flows through {@link applyTaskSettings} (tighten-only). */
 export declare function withPermissionMode(settings: ParsedTaskSettings | undefined, mode: SettingsPermissionMode): ParsedTaskSettings;
-/**
- * 7.106.0 合并复审 X8(opus O-6)—— 请求**没有表态**模式时引擎实际跑的那个词。core 7.34.0 [ref]「Absent = `default`」
- * (装树 `dist/core/runner/prepare-task.js` 的 `requested ?? "default"`)。只给**观测面**用(hook 载荷的 `permission_mode`,CC 恒带这个键):
- * spec 过境点照旧不写键(`effectivePermissionMode` 缺席 ⇒ 不替调用方选 —— 那是引擎的默认,不是本仓的表态)。
- */
-export declare const ENGINE_ABSENT_PERMISSION_MODE: "default";
 /**
  * [ref] §6-1 —— 本请求的**生效** permission mode,单点。优先序逐字同 {@link withPermissionMode}:
  * 顶层 `body.permissionMode`(本轮显式表态)赢过 bundle 的 `settings.permissions.defaultMode`;两处

package/dist/task-settings.js

@@ -47,7 +47,6 @@ export function withPermissionMode(settings, mode) {
     const base = settings ?? {};
     return { ...base, permissions: { ...base.permissions, defaultMode: mode } };
 }
-export const ENGINE_ABSENT_PERMISSION_MODE = "default";
 export function effectivePermissionMode(body, settings) {
     const requested = coercePermissionMode(body.permissionMode) ?? settings?.permissions?.defaultMode;
     const kill = settings?.permissions?.disableAutoMode;

package/dist/tool-approval.d.ts

@@ -288,7 +288,7 @@ export interface ToolApprovalFrame {
     /**
      * **S-934 ②(core 7.37.0 #1214;ADDITIVE,`"tool_approval"` only)** —— 这一问的**类**:`classes` 的首员(core `ASK_CLASSES` 序),
      * `MODE_ARBITRATION` 的行键(权限模式读的就是它 / 它们)。引擎在每一个铸 `origin` 的站盖章(策略自报的值在盖章处被替换),本仓经
-     * `approval-card.ts` 的 `readAskClassPair(req)` 结构窄读(成员筛 = core `isAskClass`,本仓不抄词表;在场却读不出 ⇒ 两键都不投 + 计一次
+     * `approval-card.ts` 的 `readAskClassPair(req)` 窄读(判法 = core 屏 `screenAskClassMembers`,S-955 ⑥ / #1249,本仓零自写对判;屏拒 ⇒ 两键都不投 + 计一次
      * S-249 集外 tag)。**与 {@link classes} 同在同缺**;缺席 = 老引擎 / 不盖类的站(共享制品读确认,core KL-1214-a),不是「无类」。
      * display:壳按类渲卡(cli 卡面、client-core CC-272),durable 审批席按类答;**本仓不按它裁决**(无人值守腿的按类作答读 core 交来的
      * `AskRequest.classes` 本身)。同一对的其余面:`card_json` 卡面 / `approval_request` 呈卡帧 / 断连重放帧(同一份素材)、运维队列行
@@ -838,6 +838,13 @@ export type UnattendedPolicyRefusal = Extract<AskOutcome, {
     settledBy: Extract<HostSettledBy, "policy">;
     reason: string;
 };
+/**
+ * {@link UnattendedPolicyRefusal} 的**唯一**构造(纯数据 ⇒ `build*`)。来源词读店落行的**同一个**常量(`POLICY_REFUSAL_DECISION`,NP-2):
+ * 行上记的与交给 core 的在构造上是一个词。两个铸点读它:协调器 deny 政策的「无人可答」({@link ToolApprovalCoordinator.unattendedOutcome})
+ * 与 run-local 本地席没有人可问的两臂(S-956:无 TTY / 参数展示不出 —— `src/run-local.ts` `createLocalApprover`)。`reason` = 铸点的
+ * 闭集拒因句(core 以 `policy note` 围栏交给模型),不带调用方的字节。
+ */
+export declare function buildUnattendedPolicyRefusal(reason: string): UnattendedPolicyRefusal;
 /** 「无人可答」终局的**闭集** —— core `AskOutcome` 联合里只有这两臂由 {@link ToolApprovalCoordinator.unattendedOutcome}
  *  铸:park 政策的路由答 `"unavailable"`,deny 政策的 {@link UnattendedPolicyRefusal}。没有布尔臂(S-689:裸 `false`
  *  是人的拒绝,这个口从不替人说话)。 */

package/dist/tool-approval.js

@@ -210,6 +210,9 @@ export function parseToolApprovalResponse(body) {
     }
     return { ok: false, error: 'decision must be one of "allow" | "allow_session" | "deny"' };
 }
+export function buildUnattendedPolicyRefusal(reason) {
+    return { allow: false, settledBy: POLICY_REFUSAL_DECISION.settledBy, reason };
+}
 function unattendedRefusalReason(arm) {
     return ("UNATTENDED_APPROVAL_POLICY=deny: this deployment declares that no one attends its approvals, so an approval " +
         `request no one can answer is refused here instead of being parked for a person (arm: ${arm}).`);
@@ -399,7 +402,7 @@ export class ToolApprovalCoordinator {
                 outcomeWord = "unavailable";
                 break;
             case "deny":
-                outcome = { allow: false, settledBy: POLICY_REFUSAL_DECISION.settledBy, reason: unattendedRefusalReason(site.arm) };
+                outcome = buildUnattendedPolicyRefusal(unattendedRefusalReason(site.arm));
                 outcomeWord = "deny";
                 break;
             default: {

package/dist/trace/core-keyset-guard.d.ts

@@ -17,7 +17,7 @@
  * ⑨⑩([ref],2026-08-31)把两个最大的 wire 面也纳入:TaskSpec 按「server 有无写点」记 Wired/Unwired,
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
-import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, SideQueryResult, WiringManifest, GateOutcome, GateDisposition, Settlement, PausedCause, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps } from "@sema-agent/core";
+import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, SideQueryResult, WiringManifest, GateOutcome, GateDisposition, Settlement, PausedCause, TerminalCause, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps, SessionMemoryStatus } from "@sema-agent/core";
 import type { ToolApprovalFrame } from "../tool-approval.js";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。
  *  🔴 **导出**([ref] U1/U2):本仓「词表闭集,未处置成员=编译红」的钉法只许有**一个**形 ——
@@ -157,6 +157,17 @@ type PausedCauseForwarded = "kind" | "gate" | "checkpointId" | "restoreMode";
 type PausedCauseStripped = "token";
 type _GuardPausedCause = AssertAllKeysHandled<Exclude<keyof PausedCause, PausedCauseForwarded | PausedCauseStripped>>;
 type _GuardPausedCauseReverse = AssertAllKeysHandled<Exclude<PausedCauseForwarded | PausedCauseStripped, keyof PausedCause>>;
+type NonPausedTerminalKeys = Exclude<TerminalCause, {
+    kind: "paused";
+}> extends infer C ? (C extends object ? keyof C : never) : never;
+type TerminalArmForwarded = "kind" | "code" | "message" | "nestedPause" | "detail" | "reason";
+type TerminalArmStripped = never;
+type _GuardTerminalArm = AssertAllKeysHandled<Exclude<NonPausedTerminalKeys, TerminalArmForwarded | TerminalArmStripped>>;
+type _GuardTerminalArmReverse = AssertAllKeysHandled<Exclude<TerminalArmForwarded | TerminalArmStripped, NonPausedTerminalKeys>>;
+type SessionMemoryStatusProjected = "captureOptedOut" | "committedCount" | "foldedCount" | "optOutSource" | "lastCaptureAt";
+type SessionMemoryStatusExcluded = "writeHome";
+type _GuardSessionMemoryStatus = AssertAllKeysHandled<Exclude<keyof SessionMemoryStatus, SessionMemoryStatusProjected | SessionMemoryStatusExcluded>>;
+type _GuardSessionMemoryStatusReverse = AssertAllKeysHandled<Exclude<SessionMemoryStatusProjected | SessionMemoryStatusExcluded, keyof SessionMemoryStatus>>;
 type SideQueryResultForwarded = "text" | "toolCalls" | "model" | "servedModel" | "degraded" | "responseModel" | "usage" | "usageMissing" | "stopReason" | "errorMessage";
 type SideQueryResultStripped = never;
 type _GuardSideQueryResult = AssertAllKeysHandled<Exclude<keyof SideQueryResult, SideQueryResultForwarded | SideQueryResultStripped>>;
@@ -226,6 +237,10 @@ type RunnerDepsLedgerWired = "fileHistoryCapture";
 type _GuardLedgerRunnerDepsReverse = AssertAllKeysHandled<Exclude<RunnerDepsLedgerWired, keyof RunnerDeps>>;
 export type CoreKeysetGuards = [
     _GuardNotification,
+    _GuardTerminalArm,
+    _GuardTerminalArmReverse,
+    _GuardSessionMemoryStatus,
+    _GuardSessionMemoryStatusReverse,
     _GuardNotificationReverse,
     _GuardProvenance,
     _GuardProvenanceReverse,

package/dist/trace/engine-notice-wire.d.ts

@@ -16,38 +16,8 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "task.tool_turn_incomplete"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
-/**
- * S-690 —— **本仓自铸**的通告码与它们的受众(码 / 铸点 / 受众三者的属主都是本仓)。
- *
- * 为什么可以有这一族:core 的 `EngineNotice.code` 刻意是开放 `string`,顶注逐字「a host forwarding its own notices
- * through the same sink is a supported shape」—— 部署经同一只 `onNotice` 转发体投自己的通告,白名单 / 归属 / 消毒 /
- * 隔离四件判据一个不绕。为什么受众写在这里:core 的 `NOTICE_AUDIENCE` 只收录 core 自己铸的码,对本仓的码
- * `noticeAudienceOf` 只会读保守默认 `"operator"` —— 那是「不认识」,不是判决。顶注的「本仓不许自造第二份受众语义」
- * 说的是 **core 的码**;本表只收 core 码册里**没有**的码,这里是它们唯一的一份受众语义。
- *
- * 🔴 机器门(`test/engine-notice-wire.test.ts` 的 server 自铸码属主门):① 本表的码与 core 运行期码册 `ENGINE_NOTICE_CODES`
- * **零交集**(core 哪天铸了同名码 ⇒ 属主变成两个,当场红:销本表的行、改走 core 的受众与工厂);② 判 `"user"` 的码必须
- * 入白名单;③ 白名单里的码,受众一律由「本表 ∪ core 注册表」给,判出来必须是 `"user"`。
- */
-export declare const SERVER_NOTICE_AUDIENCE: {
-    readonly "instructions.source_changed": "user";
-    /**
-     * O2(7.101.0 合并复审)—— boot 期探测到 ≤7.30.x 引擎留下的锁住的记忆层(唯一铸点 `src/memory-layer-legacy-lock.ts`,
-     * 调用点 = `boot/stores.ts` 的 file 记忆引擎装配段)。受众 **operator**:恢复动词是运维在数据根上执行一次 `chmod -R u+w`,
-     * 而且铸在 boot 期、没有任何会话 ⇒ 不上 wire、不进白名单,只走转发体的日志终点(`engine_notice` warn)。
-     * `detail: { layers, remedy }` —— 层名(挂载面的直接子目录名)与那一句补救;条目名 / 内容不进。
-     */
-    readonly "memory.layer_locked_legacy": "operator";
-    /** S-612 —— 会话存档部分记录被跳过(唯一铸点 `src/session-records-skipped-notice.ts`);受众 user,理由见白名单键注。 */
-    readonly "session.records_skipped": "user";
-    /** S-925 —— 模型调用因建连失败终态(唯一铸点 `src/model-unreachable-notice.ts`);受众 user,理由见白名单键注。 */
-    readonly "server.model_unreachable": "user";
-};
-export type ServerNoticeCode = keyof typeof SERVER_NOTICE_AUDIENCE;
-/** 该码是否本仓自铸(属主判据单点:门与投递面都读这一个)。 */
-export declare function isServerNoticeCode(code: string): code is ServerNoticeCode;
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;
 /**
@@ -104,8 +74,19 @@ export declare function engineNoticeEventData(notice: {
     message: string;
     detail?: Record<string, unknown>;
 }, sessionId: string, nowMs: number): EngineNoticeWireRow;
-/** 一条 run 腿注册进来的投递口。抛错由 {@link EngineNoticeRouter.route} 隔离(见那里的 fail-open 登记)。 */
-export type EngineNoticeWireSink = (row: EngineNoticeWireRow) => void;
+/**
+ * 一条 run 腿注册进来的投递口。抛错由 {@link EngineNoticeRouter.route} 隔离(见那里的 fail-open 登记)。
+ * 返回值只对 {@link EngineNoticeRouter.routeConfirmed} 有意义(S-928 codex r1-F2 / r2-F1):durable 口交回它那一次账本写的 thenable,
+ * 兑现 `true` = 这一帧落进了账本;`false` / 拒绝 = 没落(写失败已由口自己留痕);同步口(live SSE)不交 thenable,**不是**落账确认。`route()` 不读返回值。
+ */
+export type EngineNoticeWireSink = (row: EngineNoticeWireRow) => unknown;
+/** 口的槽位(闭集):`live` = 流上的人(SSE),`durable` = 这条 run 的事件账。{@link EngineNoticeRouter.routeConfirmed} 只数 `durable` 槽的落账确认。 */
+export type EngineNoticeSlot = "live" | "durable";
+/** 一条腿的两只具名口(各自可缺席:bg 腿没有 live SSE,ephemeral sync 腿没有账本)。 */
+export interface EngineNoticeLegSlots {
+    readonly live?: EngineNoticeWireSink;
+    readonly durable?: EngineNoticeWireSink;
+}
 /**
  * sessionId → 该会话活跃 run 腿的投递口。**进程内**(`defaultSubagentTailBus` 同款姿势):
  * `onNotice` 是同进程的同步回调,通告与它要投的那条腿必然同副本,跨副本路由这件事结构上不存在。
@@ -130,8 +111,8 @@ export declare class EngineNoticeRouter {
      *
      * 每只口各自 try 隔离在 {@link route} 里,单口抛不牵连同腿另一口。
      */
-    registerLeg(sessionId: string, sinks: readonly EngineNoticeWireSink[]): () => void;
-    /** 单口腿的便捷形(测试与单终点腿用)。 */
+    registerLeg(sessionId: string, slots: EngineNoticeLegSlots): () => void;
+    /** 单口腿的便捷形(测试用):登记为 **durable** 槽 —— 这样 `route()` 与 `routeConfirmed()` 两条路都能用一只口测到(live 槽对后者结构上恒不计)。 */
     register(sessionId: string, sink: EngineNoticeWireSink): () => void;
     /** 诊断/门用:某会话此刻**最新代**有几只口在听(旧代不计——它们收不到帧)。 */
     sinkCount(sessionId: string): number;
@@ -148,6 +129,20 @@ export declare class EngineNoticeRouter {
         detail?: Record<string, unknown>;
         sessionId?: unknown;
     }, nowMs?: number): number;
+    /**
+     * S-928(codex r1-F2 / r2-F1;[ref] opus 腿 L2 改按槽判):同一只扇出,但**等**每只口交回的持久化结果 —— 返回**确认落账**的口数:
+     * 只数 **`durable` 槽**里交回 thenable 且兑现 `true` 的口;兑现 `false` / 拒绝不算;`live` 槽**结构上不计**(不管它返回什么 —— 流上的人收没收到说明不了落账;
+     * 修前按「交回 thenable」反推是不是 durable 口,哪天 live 口改成 async 返回 `true` 就会被计成落账)。给「投出之后要记一笔『告知过』」的铸点用:
+     * 记账必须跟在**落账**之后,不能跟在「调用了口」之后(后台腿唯一的口是事件账 append,写失败时 `route()` 的计数照样是 1)。判据(白名单 / 归属 / 最新代 / 隔离)与 `route()` 逐字同一条。
+     */
+    routeConfirmed(notice: {
+        code: string;
+        message: string;
+        detail?: Record<string, unknown>;
+        sessionId?: unknown;
+    }, nowMs?: number): Promise<number>;
+    /** 两只入口共用的扇出:返回每只**没抛**的口的持久化结果(promise 形一律先接住拒绝 ⇒ 绝不留未处理拒绝)。 */
+    private fanOut;
 }
 /** 进程单例(`defaultSubagentTailBus` 同款):分流器与 run 腿直接 import,不穿长参数列表;测试自 new 独立实例。 */
 export declare const defaultEngineNoticeRouter: EngineNoticeRouter;

package/dist/trace/engine-notice-wire.js

@@ -33,16 +33,8 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "permission.ask_released_by_mode",
     "permission.read_deny_unapplied",
     "permission.rule_store_unavailable",
+    "task.tool_turn_incomplete",
 ];
-export const SERVER_NOTICE_AUDIENCE = {
-    "instructions.source_changed": "user",
-    "memory.layer_locked_legacy": "operator",
-    "session.records_skipped": "user",
-    "server.model_unreachable": "user",
-};
-export function isServerNoticeCode(code) {
-    return Object.hasOwn(SERVER_NOTICE_AUDIENCE, code);
-}
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {
     return WIRE_CODES.has(code);
@@ -107,11 +99,13 @@ export function engineNoticeEventData(notice, sessionId, nowMs) {
         ts: nowMs,
     };
 }
+const isThenableResult = (v) => typeof v === "object" && v !== null && typeof v.then === "function";
 let nextLegId = 1;
 export class EngineNoticeRouter {
     legs = new Map();
-    registerLeg(sessionId, sinks) {
-        const leg = { legId: nextLegId++, sinks: [...sinks] };
+    registerLeg(sessionId, slots) {
+        const sinks = [...(slots.live ? [{ slot: "live", sink: slots.live }] : []), ...(slots.durable ? [{ slot: "durable", sink: slots.durable }] : [])];
+        const leg = { legId: nextLegId++, sinks };
         const list = this.legs.get(sessionId) ?? [];
         list.push(leg);
         this.legs.set(sessionId, list);
@@ -131,7 +125,7 @@ export class EngineNoticeRouter {
         };
     }
     register(sessionId, sink) {
-        return this.registerLeg(sessionId, [sink]);
+        return this.registerLeg(sessionId, { durable: sink });
     }
     sinkCount(sessionId) {
         const list = this.legs.get(sessionId);
@@ -141,27 +135,34 @@ export class EngineNoticeRouter {
         return this.legs.get(sessionId)?.length ?? 0;
     }
     route(notice, nowMs = Date.now()) {
+        return this.fanOut(notice, nowMs).length;
+    }
+    async routeConfirmed(notice, nowMs = Date.now()) {
+        const outcomes = await Promise.all(this.fanOut(notice, nowMs));
+        return outcomes.filter((ok) => ok).length;
+    }
+    fanOut(notice, nowMs) {
         if (!isEngineNoticeWireCode(notice.code))
-            return 0;
+            return [];
         const sessionId = engineNoticeSessionId(notice);
         if (sessionId === undefined)
-            return 0;
+            return [];
         const list = this.legs.get(sessionId);
         const leg = list && list.length > 0 ? list[list.length - 1] : undefined;
         if (!leg || leg.sinks.length === 0)
-            return 0;
+            return [];
         const row = engineNoticeEventData(notice, sessionId, nowMs);
-        let delivered = 0;
-        for (const sink of leg.sinks) {
+        const outcomes = [];
+        for (const { slot, sink } of leg.sinks) {
             try {
-                sink(row);
-                delivered++;
+                const result = sink(row);
+                outcomes.push(isThenableResult(result) ? Promise.resolve(result).then((v) => slot === "durable" && v === true, () => false) : Promise.resolve(false));
             }
             catch {
                 recordFailOpen("server.engine-notice.wire-sink-threw", `code=${notice.code}`);
             }
         }
-        return delivered;
+        return outcomes;
     }
 }
 export const defaultEngineNoticeRouter = new EngineNoticeRouter();
@@ -169,11 +170,10 @@ export function registerEngineNoticeLeg(opts) {
     const { sessionId, live, durable } = opts;
     if (sessionId === undefined || sessionId.length === 0)
         return () => undefined;
-    const sinks = [...(live ? [live] : []), ...(durable ? [durable] : [])];
-    if (sinks.length === 0)
+    if (live === undefined && durable === undefined)
         return () => undefined;
     const router = opts.router ?? defaultEngineNoticeRouter;
-    const unregister = router.registerLeg(sessionId, sinks);
+    const unregister = router.registerLeg(sessionId, { ...(live ? { live } : {}), ...(durable ? { durable } : {}) });
     for (const notice of opts.pending ?? [])
         router.route(notice);
     return unregister;