@sema-agent/server 7.113.0 → 7.115.0

package/dist/runtime-governance.d.ts

@@ -97,6 +97,19 @@ export declare function validateCommandRules(rules: CommandRule[]): string[];
  * 闭集本身则由契约 zod 派生 ⇒ 契约加一个判词,`RANK` 与桶分配的穷尽 switch 双双**编译红**。
  */
 export declare function compileCommandPolicyLayers(rules: CommandRule[] | undefined): ToolPolicy[];
+/** 运维 allow 规则表的出处名 = 它的 env 名(盖进每条规则;编不出来 / 不合文法时拒启句的主语)。 */
+export declare const APPROVAL_GRANT_SOURCE = "APPROVAL_GRANT";
+/**
+ * 7.115.0 —— 运维的 allow 规则(`APPROVAL_GRANT`)编成治理层的**叶**(空 / 缺席 ⇒ `[]`,本层一片叶都不铸,折叠逐字与修前同)。
+ *
+ * 编译口是**请求腿 `settings.permissions.allow` 的同一只**(`permission-rule-list.ts` `createRuleListPolicy`,`behavior: "allow"`):命中 = core 带
+ * `decisionReason: "rule"` 的放行(折叠把这句表态带到终局,引擎据此不再为没人表态的服务器工具调用出 `unstated` 卡);未命中 = 裸 allow =
+ * 不表态。它是一片**不收紧**的叶 —— 与 commandPolicy / 守卫集同住一个折叠点,只因为三者是同一个「部署说的话」:折叠 deny > ask > allow,
+ * 同折叠里任何一片叶的 deny / ask、`tightenTaskSpec` 之下的审批基线、之上的请求 settings 与会话规则,照旧压过它。
+ *
+ * 启动校验(`config.ts` `approvalGrantRefusal`)试编的也是本函数 —— 拒启判据与运行期编译是同一只,不会出现「启动收下、任务里编不出来」。
+ */
+export declare function compileApprovalGrantLayers(grant: readonly string[] | undefined): ToolPolicy[];
 /**
  * Expand an autonomy mode into TIGHTEN-ONLY `TaskSpec` safety overrides (the primitives — TRAP #2):
  *  - `read-only` / `plan` → `handsReadOnly: true` **+ `writeFace: "roots"`** (read + propose, never mutate; the
@@ -203,13 +216,18 @@ export declare function governanceOriginOf(gate: {
     };
 } | undefined, governance: GovernancePosture | undefined): true | undefined;
 /**
- * Apply the operator's runtime governance (autonomy + commandPolicy + manualModeShellGate) onto a base
+ * Apply the operator's runtime governance (autonomy + commandPolicy + manualModeShellGate + the guard set + the
+ * `APPROVAL_GRANT` allow rules) onto a base
  * `TaskSpec`, TIGHTEN-ONLY, in a SINGLE {@link tightenTaskSpec} call: commandPolicy compiles to a `toolPolicy`
  * override (combined onto the baseline by `tightenTaskSpec` — TRAP #1), and autonomy expands to
  * `handsReadOnly` / `shellGate` overrides (TRAP #2). `tightenTaskSpec` THROWS `TaskSpecTightenError` if any
  * override would LOOSEN a stricter base safety field — surfacing a misconfiguration loudly instead of silently
  * weakening the gate. Returns `base` untouched when there is nothing to apply.
  *
+ * 7.115.0:`APPROVAL_GRANT` 是这里唯一一片**不收紧**的叶 —— 它只给出 allow 的那句表态(core 7.40.0 起没人表态的服务器工具调用要问,
+ * 运维的规则就是那句答),从不清掉任何 deny / ask:折叠 deny > ask > allow,所以「部署 ⊇ 操作员 ⊇ 客户端只能收窄」的不变量逐字成立。
+ * 编译口与请求腿的 allow 桶同一只({@link compileApprovalGrantLayers})。
+ *
  * [ref]([ref] server 分单②):`MANUAL_MODE_SHELL_GATE` 从 settings 折叠搬到这里**无条件施加**。旧家
  * (task-settings deriveSettingsPolicy 的 default/auto/acceptEdits 三臂)让一个**部署级 tighten-only 旋钮
  * 的生死由客户端表态在场性决定**:body 无 settings/permissionMode(cli print/headless 腿按设计不 stamp)
@@ -242,6 +260,8 @@ export declare function applyRuntimeGovernance(base: TaskSpec, governance: {
     /** 守卫集的**叶**(`deployment-governance.ts` `createDeploymentGovernanceInputs` 预铸;S-958 起是叶的列表,不是一只预折的策略)。
      *  空列表与缺席同义。 */
     sensitivePathLayers?: readonly ToolPolicy[];
+    /** 7.115.0:运维的 allow 规则(`APPROVAL_GRANT` 原串;本函数经 {@link compileApprovalGrantLayers} 编成叶)。空列表与缺席同义。 */
+    approvalGrant?: readonly string[];
     /** [ref]/[ref] `governanceForced` 的标记表(缺省 = **当前 run 腿的 ALS 表**,见
      *  `governance-ask-marks.ts` 顶注「作用域」段)。注入口只为测试与将来的多实例形。 */
     askMarks?: GovernanceAskMarks;

package/dist/runtime-governance.js

@@ -2,6 +2,7 @@ import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createC
 import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
 import { createDeploymentAuthoredPolicy, operatorAsk } from "./operator-ask.js";
+import { createRuleListPolicy } from "./permission-rule-list.js";
 import { heldRuleName } from "./tool-rule-names.js";
 const COMMAND_RULE_SHAPE = GovernanceConfig.shape.commandPolicy.unwrap().element.shape;
 const COMMAND_DECISIONS = COMMAND_RULE_SHAPE.decision.options;
@@ -100,6 +101,10 @@ export function compileCommandPolicyLayers(rules) {
     }
     return policies;
 }
+export const APPROVAL_GRANT_SOURCE = "APPROVAL_GRANT";
+export function compileApprovalGrantLayers(grant) {
+    return grant !== undefined && grant.length > 0 ? [createRuleListPolicy(grant, "allow", APPROVAL_GRANT_SOURCE, undefined)] : [];
+}
 export function autonomyOverrides(autonomy) {
     switch (autonomy) {
         case "read-only":
@@ -143,7 +148,7 @@ function createGovernanceShellGateMarkPolicy(marksOf, tools = COARSE_SHELL_TOOLS
 export function applyRuntimeGovernance(base, governance) {
     const marksOf = () => governance.askMarks ?? currentGovernanceAskMarks();
     const overrides = { ...autonomyOverrides(governance.autonomy) };
-    const layers = [...compileCommandPolicyLayers(governance.commandPolicy), ...(governance.sensitivePathLayers ?? [])];
+    const layers = [...compileCommandPolicyLayers(governance.commandPolicy), ...(governance.sensitivePathLayers ?? []), ...compileApprovalGrantLayers(governance.approvalGrant)];
     const governancePolicy = layers.length > 0 ? createGovernanceAskMarkingPolicy(combinePolicies(...layers.map(createDeploymentAuthoredPolicy)), marksOf) : undefined;
     if (governancePolicy !== undefined)
         overrides.toolPolicy = governancePolicy;

package/dist/security.js

@@ -65,7 +65,7 @@ export function createAuthorizer(config, sessionStore) {
                 let owner = await ownerOf(requested);
                 if (owner === undefined) {
                     if (requireExisting) {
-                        throw new HttpError(404, "requireExistingSession: session does not exist (resume.session_not_found)");
+                        throw createCodedHttpError(404, "resume.session_not_found", "requireExistingSession: session does not exist (resume.session_not_found)");
                     }
                     if (register) {
                         await register(requested, principal ?? null);
@@ -89,7 +89,7 @@ export function createAuthorizer(config, sessionStore) {
         }
         else {
             if (requireExisting) {
-                throw new HttpError(422, "requireExistingSession requires a sessionId — there is no existing session to resume (resume.session_not_found)");
+                throw createCodedHttpError(422, "request.field_conflict", "requireExistingSession requires a sessionId — there is no existing session to resume");
             }
             sessionId = uuidv7();
             if (register)

package/dist/session-policy-wire.d.ts

@@ -66,10 +66,11 @@ export type ToolNameRuleField = {
  * 「照 #1156 未随本版」);同版新导出的 `rosterToolName` / `ruleNamesOf`(#1194)是**别名归一**(一个名字在名册上落到哪只行的线名 /
  * 一次调用可被规则拼成的名字集),不回答「这个名字会不会让准备阶段拒启」,不能替本函数 ⇒ 本函数照留,等 #1156。
  *
- * 🔴 **为什么不复用 `config.ts` 的 `findUnmatchableToolNames`**(本仓另一只按名字判的单点;读过实现后裁):两只回答的
- * 不是同一个问题。那一只问「部署名单里这条名字会不会**永远匹配不上**活工具」—— 它刻意豁免 `allow`(白名单匹配不上 =
- * fail-closed 且当场可见),并且拒两段 MCP 名 `mcp__srv`(一名两义)与 core 文法编不出的串。本函数问的是「引擎见到这条
- * 会话规则会不会**拒启**」:引擎准备阶段的名审计对 `allow` 桶照样抛(豁免它 = 放过一条砖化路径),对 `mcp__srv` 却
+ * 🔴 **为什么不复用 `config.ts` 的 `unmatchableToolNamesRefusal`**(本仓另一只按名字判的单点;读过实现后裁):两只回答的
+ * 不是同一个问题。那一只问「这张表里这条条目会不会**永远不生效**」(匹配不上活工具,或编不成一条规则)—— 7.115.0 起它对 `allow` 也照判
+ * (修前豁免 `allow`:那时 allow 是白名单,匹配不上 = fail-closed 且当场可见;allow 改成 allow 规则后豁免臂已删),并且拒两段 MCP 名
+ * `mcp__srv`(一名两义)与 core 文法编不出的串。本函数问的是「引擎见到这条会话规则会不会**拒启**」:引擎准备阶段的名审计对会话规则的
+ * `allow` 桶照样抛,对 `mcp__srv` 却
  * **不**抛(会话层自 core 5.55 / 5.56 起把它当整对端覆盖形真命中)。判据只能逐字跟 core 那两臂走,不能借另一只的口径。
  * 两只在「退役名」「无前缀 `__` 名」两臂上同源(都读 core 导出的同两件),#1156 到货的那一批一并换调 core 的导出函数。
  */

package/dist/store-posture.d.ts

@@ -12,7 +12,7 @@
  * 由调用方自己读出落差。`degradedReason` present-iff 降级臂走过(按后端族定词,{@link storeDegradedReasonFor})。
  * 顶层 `sql` 并入 `store.sql`(硬 breaking,零别名;对象逐字同形)。
  */
-import { type DbBackendWord } from "./config-types.js";
+import type { StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import type { StoreBackend } from "./plugins/store-backend.js";
 import type { SqlEngineFacts } from "./plugins/sql-driver.js";
 import { type SqlEngineCapability } from "./sql-engine-posture.js";
@@ -25,23 +25,23 @@ import { type SqlEngineCapability } from "./sql-engine-posture.js";
 export declare const STORE_DEGRADED_REASONS: readonly ["db_unreachable", "local_unwritable"];
 export type StoreDegradedReason = (typeof STORE_DEGRADED_REASONS)[number];
 /** 降级臂按后端族定词(穷举 switch:词表加员 ⇒ 编译红)。`memory` 从不尝试打开后端,走不到降级臂 —— 到了就是装配缺陷,响亮抛。 */
-export declare function storeDegradedReasonFor(declared: DbBackendWord): StoreDegradedReason;
+export declare function storeDegradedReasonFor(declared: StoreBackendWord): StoreDegradedReason;
 /** 装配值(纯数据;`boot/stores.ts` 铸一次,gauge / `/health` / caps 三面同读)。 */
 export interface StorePosture {
-    readonly declared: DbBackendWord;
-    readonly backend: DbBackendWord;
+    readonly declared: StoreBackendWord;
+    readonly backend: StoreBackendWord;
     readonly degradedReason?: StoreDegradedReason;
 }
 /** `build*`(纯数据)。`assembled` = 装配出的 `StoreBackend.kind`;缺席 = 没装出后端 ⇒ `memory`。 */
 export declare function buildStorePosture(a: {
-    readonly declared: DbBackendWord;
+    readonly declared: StoreBackendWord;
     readonly assembled: StoreBackend["kind"] | undefined;
     readonly degradedReason: StoreDegradedReason | undefined;
 }): StorePosture;
 /** caps `store` 的形。 */
 export interface StoreCapability {
-    readonly declared: DbBackendWord;
-    readonly backend: DbBackendWord;
+    readonly declared: StoreBackendWord;
+    readonly backend: StoreBackendWord;
     readonly durable: boolean;
     readonly degradedReason?: StoreDegradedReason;
     /** 7.105.0 及以前的顶层 `sql` 对象,原样搬入(`{engine, isolation, txnMode}`)。present-iff `backend ∈ {mysql, pg}` ∧ 驱动此刻给得出

package/dist/store-posture.js

@@ -1,4 +1,3 @@
-import {} from "./config-types.js";
 import { projectSqlEngineCapability } from "./sql-engine-posture.js";
 export const STORE_DEGRADED_REASONS = ["db_unreachable", "local_unwritable"];
 export function storeDegradedReasonFor(declared) {

package/dist/task-settings.d.ts

@@ -12,9 +12,12 @@
  * idempotent (the same tighten), so no special resume handling is needed (mirrors runtime-governance).
  *
  * 🔒 SECURITY INVARIANTS (SDK settings.ts §3.3):
- *  - permissions are TIGHTEN-ONLY — folded via `tightenTaskSpec` (deny-wins `combinePolicies`); it THROWS on any
- *    override that would LOOSEN a stricter base safety field. The client can only ADD denies/asks/handsReadOnly on
- *    top of the deployment + operator baseline, never widen it.
+ *  - permissions are folded via `tightenTaskSpec` (deny-wins `combinePolicies`); it THROWS on any override that would
+ *    LOOSEN a stricter base safety field. The client can ADD denies/asks/handsReadOnly on top of the deployment +
+ *    operator baseline, never widen it. Its `allow` rules (S-654 (c), 7.115.0) STATE an allow for the tools they name —
+ *    the answer core 7.40.0 wants before it runs an MCP / A2A call nobody stated — and never override a deny or an ask
+ *    from any layer (deny > ask > allow); a miss has no opinion. They release no ask a layer raises itself: on built-in
+ *    tools the engine's own write gate and shell checks still ask (unlike the reference implementation's `permissions.allow`).
  *  - permissionMode(轴B #2 注释保鲜,1.254——[ref]/[ref] 后的真实现):`defaultMode` 收**五**模式
  *    (default | acceptEdits | plan | bypassPermissions | auto),bypass/auto 被 HONOR 为 gate-shape 选择
  *    ——但深层不变量未变:bypass=「不加 ask 门」,恒不越部署基线(tightenTaskSpec deny-wins,基线 deny/
@@ -224,8 +227,6 @@ export interface ParseTaskSettingsResult {
  *  posture (an uncapped prompt body is a per-turn token-cost hole; cross review). Exported so the HTTP layer
  *  (prepareSpec) can 400 fail-loud on submit with the SAME bound this defensive parse enforces on every path. */
 export declare const MAX_SETTINGS_OUTPUT_STYLE_CHARS = 16384;
-/** Cap on the element count of each permission list (allow/deny/ask) — bounds a pathological rule blast. */
-export declare const MAX_SETTINGS_PERMISSION_RULES = 1000;
 /** Caps on `settings.env` — bound a pathological env blast (count + per-value length; values land in the shell env). */
 export declare const MAX_SETTINGS_ENV_VARS = 256;
 export declare const MAX_SETTINGS_ENV_VALUE_CHARS = 32768;
@@ -298,6 +299,19 @@ export declare const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS: readonly ["addit
  *  · `permissions: null` 是既有钉住的「容器缺席」形,照旧不咬。
  */
 export declare function taskSettingsKeyIssue(raw: unknown): KeyClosureIssue | null;
+/**
+ * 🔒 **`settings.hooks` 会不会被采纳** —— 全仓**唯一**的车道谓词(S-995,主会话裁):hook 命令跑在 WORKER HOST([ref] class ② 能力授予),所以只有单用户车道
+ * (`requirePrincipal !== true`,与 scheduler / backgroundShell / lspHost / MCP 注入同一姿势)采纳;多租户车道收到 hooks **整只忽略**(`task_hooks_ignored`),绝不执行。
+ * 三处读它,谁也不许内联 `requirePrincipal`(各写各的 = 迟早漂):
+ *  · `boot/resolve-spec.ts` —— 装配:不采纳 ⇒ 不装 `TaskSpec.hooks` + 一条 `task_hooks_ignored`;
+ *  · `http/routes/capabilities.ts` —— 能力位 `taskSettings.hooks`(「says yes ⟺ route works」);
+ *  · `http/admission.ts` —— fresh 受理面的「别名 matcher 永不命中」判据的**求值深度**:采纳 ⇒ `"regex"`(运行期同一只匹配函数,带资源闸);不采纳 ⇒ `"literal"`
+ *    (7.112.0 的字面判:零调用方正则执行 —— 受理面是所有车道,租户不能借一只灾难回溯的 matcher 占满事件循环)。
+ * `test/hooks-alias-matcher-s995.test.ts` R5g 钉「三处都调它、没有内联判据」。
+ */
+export declare function taskHooksHonored(config: {
+    readonly requirePrincipal?: boolean;
+}): boolean;
 /**
  * Validate an untrusted `body.settings` (raw `unknown` off the wire) into the service-trusted {@link
  * ParsedTaskSettings}. NEVER trusts the wire type — every field is shape-checked. `defaultMode` accepts the FIVE

package/dist/task-settings.js

@@ -1,6 +1,6 @@
-import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createPermissionRulePolicy, parseRuleText, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, ruleToolGrammarOf, } from "@sema-agent/core";
-import { findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
-import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { combinePolicies, createFsWriteGatePolicy, parseRuleText, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, ruleToolGrammarOf, } from "@sema-agent/core";
+import { unmatchableToolNamesRefusal } from "./config.js";
+import { MAX_PERMISSION_RULES_PER_LIST, createRuleListPolicy } from "./permission-rule-list.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 import { heldRuleName } from "./tool-rule-names.js";
@@ -61,7 +61,6 @@ export function skillListingMaxDescOk(v) {
     return typeof v === "number" && Number.isSafeInteger(v) && v > 0;
 }
 export const MAX_SETTINGS_OUTPUT_STYLE_CHARS = 16_384;
-export const MAX_SETTINGS_PERMISSION_RULES = 1_000;
 export const MAX_SETTINGS_ENV_VARS = 256;
 export const MAX_SETTINGS_ENV_VALUE_CHARS = 32_768;
 export const MAX_SETTINGS_ENV_KEY_CHARS = 256;
@@ -106,8 +105,8 @@ export function settingsPermissionBucketIssue(perms) {
         let fields;
         if (!Array.isArray(v))
             fields = { field, reason: "bad_entry" };
-        else if (v.length > MAX_SETTINGS_PERMISSION_RULES)
-            fields = { field, reason: "over_cap", count: v.length, cap: MAX_SETTINGS_PERMISSION_RULES };
+        else if (v.length > MAX_PERMISSION_RULES_PER_LIST)
+            fields = { field, reason: "over_cap", count: v.length, cap: MAX_PERMISSION_RULES_PER_LIST };
         else {
             const index = v.findIndex((x) => typeof x !== "string" || x.length === 0);
             if (index >= 0)
@@ -158,6 +157,9 @@ export function taskSettingsKeyIssue(raw) {
         unsupportedKeys: unsupported.slice(0, MAX_KEY_ECHO),
     };
 }
+export function taskHooksHonored(config) {
+    return config.requirePrincipal !== true;
+}
 export function parseTaskSettings(raw) {
     if (raw === null || raw === undefined || typeof raw !== "object")
         return { deferred: [] };
@@ -263,20 +265,7 @@ export function acceptAppendSystemPrompt(v, warn, packDropsAppend) {
     }
     return v;
 }
-const RULE_SOURCE_BY_BEHAVIOR = { ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
-function createRuleListPolicy(names, behavior, pathBases) {
-    try {
-        return createPermissionRulePolicy(names.map((name) => ({ rule: name, behavior, source: RULE_SOURCE_BY_BEHAVIOR[behavior] })), {
-            defaultAction: "allow",
-            caps: { maxRules: MAX_SETTINGS_PERMISSION_RULES },
-            ...(pathBases !== undefined ? { pathBases } : {}),
-        });
-    }
-    catch (e) {
-        const coreMsg = (e instanceof Error ? e.message : String(e)).replace(CONTROL_AND_BIDI_STRIP_RE, "");
-        throw new Error(`${RULE_SOURCE_BY_BEHAVIOR[behavior].replace("settings.", "")} has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
-    }
-}
+const RULE_SOURCE_BY_BEHAVIOR = { allow: "settings.permissions.allow", ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
 const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];
 const isWorkflowName = (name) => name === RUN_WORKFLOW_TOOL_NAME;
 function createWorkflowAskPolicy(isExempt) {
@@ -324,16 +313,16 @@ function rejectUnmatchableSettingsNames(perms, pathBases) {
             }
         }
     }
-    for (const [field, names, behavior, consumer] of [
-        ["permissions.ask", perms.ask, "ask", "rule-policy"],
-        ["permissions.deny", perms.deny, "deny", "rule-policy"],
-        ["permissions.allow", perms.allow, "allow", "tool-name-table"],
+    for (const [field, names, behavior] of [
+        ["permissions.ask", perms.ask, "ask"],
+        ["permissions.deny", perms.deny, "deny"],
+        ["permissions.allow", perms.allow, "allow"],
     ]) {
         if (!names)
             continue;
-        const bad = findUnmatchableToolNames(names, { consumer, behavior, ...(pathBases !== undefined ? { pathBases } : {}) });
-        if (bad.length > 0)
-            throw new Error(formatUnmatchableToolNames(field, bad));
+        const unmatchable = unmatchableToolNamesRefusal(field, names, { consumer: "rule-policy", behavior, ...(pathBases !== undefined ? { pathBases } : {}) });
+        if (unmatchable !== undefined)
+            throw new Error(unmatchable.message);
     }
 }
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
@@ -347,11 +336,11 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
     rejectUnmatchableSettingsNames(perms, pathBases);
     const policies = [];
     if (allow)
-        policies.push(createAllowDenyPolicy({ allow }));
+        policies.push(createRuleListPolicy(allow, "allow", RULE_SOURCE_BY_BEHAVIOR.allow, pathBases));
     if (deny)
-        policies.push(createRuleListPolicy(deny, "deny", pathBases));
+        policies.push(createRuleListPolicy(deny, "deny", RULE_SOURCE_BY_BEHAVIOR.deny, pathBases));
     if (ask)
-        policies.push(createRuleListPolicy(ask, "ask", pathBases));
+        policies.push(createRuleListPolicy(ask, "ask", RULE_SOURCE_BY_BEHAVIOR.ask, pathBases));
     const fsWriteGate = (acceptCwd) => {
         if (!gate)
             return undefined;

package/dist/tool-approval.d.ts

@@ -452,10 +452,7 @@ export interface ToolApprovalFrame {
      * 耐久路的对偶 = `gate.riskDescriptor.probeCause`(同值,core `buildRiskDescriptor` 铸),走 checkpoint
      * 行的**整体透传**到 `GET /v1/approvals` —— 键集零施工,钉在同一个文件的 §4。
      *
-     * 姊妹键 `AskRequest.probeReason`(同一件事的**散文**兄弟)**今天不投影**:它与本键是同一个事实的两种
-     * 拼法,而 core 的边界哲学(交 code + 数组、不交句子)与「一张卡上不放两份同义解释」都指向只投结构化
-     * 那一份;散文那份还无法被消费端本地化。照 `preview` / `requiresRealApproval` 先例 = 候消费端(cli)
-     * 提渲染需求再翻(登记在 `trace/core-keyset-guard.ts` 的 EXCLUDED 栏)。
+     * 姊妹键 `probeReason`(同一件事的**散文**兄弟)见下一键 —— 7.115.0 起投影(S-733),与本键**并列不替代**。
      */
     probeCause?: {
         code: string;
@@ -468,6 +465,21 @@ export interface ToolApprovalFrame {
             total: number;
         };
     };
+    /**
+     * S-733(7.115.0;**ADDITIVE**,`"tool_approval"` only)—— 这次 ask 被收紧时探针给出的那一句**散文**因由
+     * (`AskRequest.probeReason`:core 在 maybe 档收紧点 `inlineUntrusted(…, 200)` 过的一句话)。与
+     * {@link probeCause}(结构化因由)**并列、不替代**:引擎自己铸的因由走结构位,**部署自写的探针**只会写这一句
+     * —— 一只只给 reason 不给 cause 的探针,此前其审批人在活卡上读不到任何因由(耐久面
+     * `gate.riskDescriptor.probeReason` 早就带着这同一句,两张脸只有一张有话说)。
+     *
+     * 🔴 **在场才带**(缺席绝不编空串;缺席 ≠「没有原因」);窄读单点 = `approval-card.ts` 的 `readProbeReason`
+     * (非串 / 空白 ⇒ 缺席;超信封 ⇒ **整只丢不截**;内容族 ⇒ 脱敏,与耐久面同一规则 ⇒ 对同一句话两面同值)。
+     * 🔴 **只在本帧上**:呈卡帧 / `card_json` 不携它(`ApprovalCardSchema` 是 `.strict()` 的耐久信封,加键要另行裁定)。
+     * 🔴 **展示 / 分诊元数据,永不是裁决输入**;永不进 `message`(那是分类器 / 模型的输入面)。
+     * `\p{Cf}` 展示重排类字符(方向 / 零宽标记):core 在这个座上**不剥**(同值契约下 core 自己披露的残余,[ref]);本仓脱敏器
+     * (`redactSecrets`)入口剥全部 `\p{Cf}`(7.70.0 起),活卡帧与耐久面**都过它** ⇒ 两面同值、且都是剥后字节(`test/approval-probe-reason-wire.test.ts` 钉)。
+     */
+    probeReason?: string;
     /**
      * [ref] 件 G2(core 5.35.0 [ref] G-2;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 背后的
      * **规则出处证据**(`AskRequest.ruleEvidence`,引擎在 gate 内盖章):org 快照 `orgRevision` / 命中的

package/dist/tool-approval.js

@@ -8,7 +8,7 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { MAX_SETTLED_BY_CHARS, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, settledByFitsColumn } from "./plugins/approval-ask-store-sql.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
@@ -1099,6 +1099,7 @@ export class ToolApprovalCoordinator {
             ...((f) => (f !== undefined ? { denialLimitFallback: f } : {}))(readDenialLimitFallback(req)),
             ...((g) => (g !== undefined ? { readRootCandidate: g } : {}))(readReadRootCandidate(req)),
             ...((c) => (c !== undefined ? { probeCause: c } : {}))(readProbeCause(req)),
+            ...((r) => (r !== undefined ? { probeReason: r } : {}))(readProbeReason(req)),
             ...((c) => (c !== undefined ? { ruleEvidence: c } : {}))(readRuleEvidence(req)),
             ...(bounded.omitted ? { argsOmitted: true } : { args: bounded.args }),
             ...(bounded.hasBidi || req.hasBidiControls === true ? { inputHasBidi: true } : {}),

package/dist/trace/core-keyset-guard.d.ts

@@ -43,8 +43,8 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes";
-type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes";
+type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
 type AskFrameServerMinted = "type" | "approvalId" | "argsOmitted" | "outcome" | "governanceForced" | "expiresAtMs" | "expiresInMs" | "serverNowMs" | "parked" | "inputHasBidi";
@@ -88,10 +88,13 @@ type _GuardWiringSessionReverse = AssertAllKeysHandled<Exclude<WiringSessionHand
 type WiringToolsHandled = "schemaVersion" | "count" | "entries" | "digest";
 type _GuardWiringTools = AssertAllKeysHandled<Exclude<keyof WiringSection<"tools">, WiringToolsHandled>>;
 type _GuardWiringToolsReverse = AssertAllKeysHandled<Exclude<WiringToolsHandled, keyof WiringSection<"tools">>>;
-type FleetExcluded = "subagentTranscripts";
-type WiringFleetHandled = "backgroundAgentStore" | "hostChildEventSink" | FleetExcluded;
+type WiringFleetHandled = "backgroundAgentStore" | "hostChildEventSink" | "subagentTranscripts";
 type _GuardWiringFleet = AssertAllKeysHandled<Exclude<keyof WiringSection<"fleet">, WiringFleetHandled>>;
 type _GuardWiringFleetReverse = AssertAllKeysHandled<Exclude<WiringFleetHandled, keyof WiringSection<"fleet">>>;
+type SubagentTranscriptTier = WiringSection<"fleet">["subagentTranscripts"];
+type SubagentTranscriptTierWords = "none" | "rows" | "full";
+type _GuardSubagentTranscriptTierWords = AssertAllKeysHandled<Exclude<SubagentTranscriptTier, SubagentTranscriptTierWords>>;
+type _GuardSubagentTranscriptTierWordsReverse = AssertAllKeysHandled<Exclude<SubagentTranscriptTierWords, SubagentTranscriptTier>>;
 type WiringMcpEntry = WiringSection<"mcp">[number];
 type WiringMcpExcluded = "error";
 type WiringMcpHandled = "name" | "source" | "status" | "errorCode" | "delivered" | "httpStatus" | "toolCount" | "liveness" | WiringMcpExcluded;
@@ -288,6 +291,8 @@ export type CoreKeysetGuards = [
     _GuardWiringToolsReverse,
     _GuardWiringFleet,
     _GuardWiringFleetReverse,
+    _GuardSubagentTranscriptTierWords,
+    _GuardSubagentTranscriptTierWordsReverse,
     _GuardWiringMcp,
     _GuardWiringMcpReverse,
     _GuardWiringRules,

package/dist/trace/project.js

@@ -499,9 +499,18 @@ export function wiringManifestEventData(ev, instructions) {
         ...(Array.isArray(parkIn.reasons) ? { reasons: parkIn.reasons.filter((r) => typeof r === "string") } : {}),
         ...(str(parkIn.checkpointDurability) !== undefined ? { checkpointDurability: parkIn.checkpointDurability } : {}),
     });
+    const subagentTranscripts = (() => {
+        if (fleetIn.subagentTranscripts === undefined)
+            return undefined;
+        const word = str(fleetIn.subagentTranscripts);
+        if (word === undefined)
+            return dropProjectedFace("wiring_manifest.fleet.subagentTranscripts is not a non-empty string");
+        return word;
+    })();
     const fleet = nonEmpty({
         ...(bool(fleetIn.backgroundAgentStore) !== undefined ? { backgroundAgentStore: fleetIn.backgroundAgentStore } : {}),
         ...(bool(fleetIn.hostChildEventSink) !== undefined ? { hostChildEventSink: fleetIn.hostChildEventSink } : {}),
+        ...(subagentTranscripts !== undefined ? { subagentTranscripts } : {}),
     });
     const permissionRules = nonEmpty({
         ...(bool(rulesIn.storeWired) !== undefined ? { storeWired: rulesIn.storeWired } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.113.0",
+  "version": "7.115.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -28,7 +28,7 @@
     "!dist/run-local-linux-x64",
     "!dist/run-local-darwin-arm64",
     "skills",
-    "scripts/retired-mode-seed-drain-local.mjs",
+    "scripts/drain-check-local.mjs",
     "deploy/sema-up",
     "docs/DEVICE-EXECUTOR-PROTOCOL.md",
     "USAGE.md",
@@ -62,8 +62,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.39.1",
-    "@sema-agent/settings-schema": "6.4.0",
+    "@sema-agent/core": "7.40.1",
+    "@sema-agent/settings-schema": "8.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",