@sema-agent/server 7.114.0 → 7.116.0

package/dist/spec-fields.d.ts

@@ -4,6 +4,7 @@
  * body WITHOUT the HTTP-layer 400 validation, so a malformed value must fall back to a safe default, never throw.
  */
 import { type AgentDefinition, type TaskSpec } from "@sema-agent/core";
+import { type UnreachableNamespacedRuleName } from "./namespaced-rule-name.js";
 /**
  * E12 — normalize `body.suggestNextPrompts` → `TaskSpec.suggestNextPrompts`. `true` = on with core defaults
  * (count 3, cheap role); an object tunes `count` (clamped 1..10) / `role` (a free string — core validates it against
@@ -42,6 +43,36 @@ export declare function normalizeResumeAtMode(v: unknown, resumeAtResolved: bool
  *  (每个定义的 whenToUse/systemPrompt 都是无条件进系统提示的 prompt 载荷),与 [ref] 退役的
  *  **技能**条数帽不是同一轴:技能清单由引擎按预算渲染(超了裁描述),agent 定义没有那个预算面。 */
 export declare const MAX_TASK_AGENTS = 32;
+/**
+ * core 7.41.0 #1303 —— 技能的两只清单 `allowedTools` / `disallowedTools`(`dist/core/agent-definition.d.ts`:本次 run 的 allow 规则来源 /
+ * deny 规则来源,不是围栏)的**形**谓词。两道技能门(顶层 `body.skills[]` 的 `validateUserSkills`、`agents[].skills[]` 的
+ * {@link SKILL_FIELD_SHAPES})**同一只**:一边判一边不判 = 同一个键两种话(S-377 baseDir 吃过的亏)。
+ *
+ * 本谓词只判「字符串数组」:引擎 `compileSkillGrant` 直接 `for (const entry of list)` —— 一个裸字符串 `"Bash"` 会被逐字符迭代成
+ * `B` / `a` / `s` / `h` 四条(deny 侧 = 意图静默落空,安全轴上的放宽方向)。条目的**文法**不在受理面判:引擎在开跑时对读不出的条目
+ * (`*` / 写路径 / 域名)发 `skills.allowed_tool_not_granted`,文法的属主是引擎(directory loader 同样原样抄、不判)。
+ * 形对之后两道门再问一问 {@link unreachableSkillToolListEntryOf}(协议名的服务器段铸不出 / 缺段 ⇒ 400)—— 那一问不是文法,是「写得出却永远匹配不到」,
+ * 与配置表、会话规则写口同一只判官。
+ * 无条数 / 长度帽([ref]:技能面的受理帽整族退役,体积由 8 MiB 请求体上限兜)。
+ */
+export declare const skillToolListOk: (v: unknown) => boolean;
+/** 技能的两只清单(`allowedTools` = allow 规则来源,`disallowedTools` = deny 规则来源;条目的工具名那一段两只同读)。 */
+declare const SKILL_TOOL_LISTS: readonly ["allowedTools", "disallowedTools"];
+/** 技能清单里一条够不着任何挂载工具的协议名条目。 */
+export interface SkillToolListUnreachable {
+    readonly key: (typeof SKILL_TOOL_LISTS)[number];
+    readonly entry: string;
+    readonly verdict: UnreachableNamespacedRuleName;
+}
+/**
+ * 一条技能(形已过两道门的字符串数组判)的两只清单里,第一条「协议名写得出、却永远匹配不到」的条目 —— 判官是 `namespaced-rule-name.ts` 那一只
+ * (配置表 / 请求三桶 / 会话规则写口同调),条目的工具名那一段经同一只 `ruleEntryToolName` 取(与配置表的规则编译器消费者同读)。都够得着 ⇒ `undefined`。
+ * 两处受理口同调:顶层 `skills[]`(`http/admission.ts` 的 `validateUserSkills`)、子代 `agents[].skills[]`({@link validateTaskAgents})。
+ * 续跑重放**不问**这一问(两层都是:重放腿不过受理口,存量体照旧原样交给引擎 —— 引擎把它编成一条永不命中的规则,与修前同一种命运,不另开读法)。
+ */
+export declare function unreachableSkillToolListEntryOf(skill: Record<string, unknown>): SkillToolListUnreachable | undefined;
+/** 两处受理口同一句(句子的后半与配置表 / 会话规则写口同一只 `describeUnreachableNamespacedRuleName`)。 */
+export declare function describeUnreachableSkillToolListEntry(u: SkillToolListUnreachable): string;
 /** [ref] 单条 agent 定义的形状裁决:null=合法;否则一句可 400 的英文错误(不带索引,调用方自己加)。
  *  白名单外键 fail-loud —— 与 resilience/limits 的「容忍未知键」相反:agents 是能力定义,静默丢字段 =
  *  定义被悄悄削(一个丢掉的 isolation 就是放宽),比 400 更危险,故整条拒。⚠️ 已知残账(core 半场):
@@ -157,4 +188,5 @@ export declare function normalizeApproachNotice(raw: unknown): false | {
  * 全空 ⇒ undefined(spec 不挂 limits 键,byte-compat)。
  */
 export declare function resolveTaskLimits(bodyLimits: unknown, caps: TaskLimitCaps, envTimeoutSec: number, requirePrincipal: boolean | undefined, big: boolean, warn?: (event: string, fields: Record<string, unknown>) => void): TaskSpec["limits"];
+export {};
 //# sourceMappingURL=spec-fields.d.ts.map

package/dist/spec-fields.js

@@ -1,6 +1,7 @@
 import { isThinkingLevel } from "@sema-agent/core";
 import { taskWallClockSec } from "./task-workflow.js";
 import { isValidCwd } from "./task-cwd.js";
+import { describeUnreachableNamespacedRuleName, ruleEntryToolName, unreachableNamespacedRuleNameOf } from "./namespaced-rule-name.js";
 export function normalizeSuggestNextPrompts(v) {
     if (v === true)
         return true;
@@ -65,28 +66,34 @@ const toolList = (v) => Array.isArray(v) &&
     v.length <= MAX_AGENT_TOOLS &&
     v.every((x) => typeof x === "string" && x.length > 0 && x.length <= MAX_AGENT_TOOL_NAME_CHARS);
 const plainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-const skillManifestOk = (m) => {
-    if (!plainObject(m))
-        return false;
-    for (const k of Object.keys(m)) {
-        if (k !== "allowTools" && k !== "allowPaths" && k !== "egress" && k !== "lineageId")
-            return false;
+export const skillToolListOk = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+const SKILL_TOOL_LISTS = ["allowedTools", "disallowedTools"];
+export function unreachableSkillToolListEntryOf(skill) {
+    for (const key of SKILL_TOOL_LISTS) {
+        const list = skill[key];
+        if (!Array.isArray(list))
+            continue;
+        for (const entry of list) {
+            if (typeof entry !== "string")
+                continue;
+            const verdict = unreachableNamespacedRuleNameOf(ruleEntryToolName(entry));
+            if (verdict !== undefined)
+                return { key, entry, verdict };
+        }
     }
-    if (!(Array.isArray(m.allowTools) && m.allowTools.every((x) => typeof x === "string")))
-        return false;
-    if (m.allowPaths !== undefined && !(Array.isArray(m.allowPaths) && m.allowPaths.every((x) => typeof x === "string")))
-        return false;
-    if (m.egress !== undefined && typeof m.egress !== "boolean")
-        return false;
-    return typeof m.lineageId === "string" && m.lineageId.length > 0;
-};
+    return undefined;
+}
+export function describeUnreachableSkillToolListEntry(u) {
+    return `skill.${u.key} names "${u.entry}", which can never match a tool (${describeUnreachableNamespacedRuleName(u.verdict)})`;
+}
 const skillFilesOk = (v) => Array.isArray(v) &&
     v.every((f) => plainObject(f) && typeof f.path === "string" && f.path.length > 0 && typeof f.content === "string");
 const SKILL_FIELD_SHAPES = {
     name: { required: true, ok: (v) => typeof v === "string" && v.length > 0 },
     description: { required: true, ok: (v) => typeof v === "string" },
     content: { required: true, ok: (v) => typeof v === "string" && v.length > 0 && v.length <= MAX_AGENT_SKILL_CONTENT_CHARS },
-    manifest: { required: false, ok: skillManifestOk },
+    allowedTools: { required: false, ok: skillToolListOk },
+    disallowedTools: { required: false, ok: skillToolListOk },
     files: { required: false, ok: skillFilesOk },
     baseDir: { required: false, ok: isValidCwd },
 };
@@ -136,7 +143,7 @@ const TASK_AGENT_FIELD_SHAPES = {
     allowTools: { desc: `an array of at most ${MAX_AGENT_TOOLS} non-empty strings of at most ${MAX_AGENT_TOOL_NAME_CHARS} characters each`, ok: toolList },
     denyTools: { desc: `an array of at most ${MAX_AGENT_TOOLS} non-empty strings of at most ${MAX_AGENT_TOOL_NAME_CHARS} characters each`, ok: toolList },
     skills: {
-        desc: "an array of { name, description, content } skill objects (optional manifest/files/baseDir; files entries need { path, content }; baseDir must be an absolute path with no \"..\" segment) — no count cap; the engine renders the listing within its own byte budget",
+        desc: "an array of { name, description, content } skill objects (optional allowedTools/disallowedTools/files/baseDir; allowedTools/disallowedTools are arrays of strings; files entries need { path, content }; baseDir must be an absolute path with no \"..\" segment) — no count cap; the engine renders the listing within its own byte budget",
         ok: (v) => Array.isArray(v) && v.every(skillOk),
     },
     background: { desc: "a boolean", ok: (v) => typeof v === "boolean" },
@@ -187,6 +194,14 @@ export function validateTaskAgents(v) {
         const issue = taskAgentIssue(v[i]);
         if (issue)
             return `agents[${i}]: ${issue}`;
+        const skills = v[i].skills;
+        if (Array.isArray(skills)) {
+            for (let j = 0; j < skills.length; j++) {
+                const unreachable = unreachableSkillToolListEntryOf(skills[j]);
+                if (unreachable !== undefined)
+                    return `agents[${i}]: skills[${j}]: ${describeUnreachableSkillToolListEntry(unreachable)}`;
+            }
+        }
         const name = v[i].name;
         if (names.has(name))
             return `agents[${i}]: duplicate agent name "${name}"`;

package/dist/standing-answer-grant.d.ts

@@ -0,0 +1,8 @@
+/** 读口的入参:任何一种载着「这一问」的形(活的 `AskRequest`、`ToolCallRequest`、待决条目、停驻行的 `tool_approval` 臂)都结构上满足。 */
+export interface StandingAnswerGrantCarrier {
+    readonly toolName?: unknown;
+    readonly boundGrantDigest?: unknown;
+}
+/** 这一问的应答是否授予这一次调用之外的东西(读法见文件头注)。 */
+export declare function answerGrantsBeyondCall(carrier: StandingAnswerGrantCarrier): boolean;
+//# sourceMappingURL=standing-answer-grant.d.ts.map

package/dist/standing-answer-grant.js

@@ -0,0 +1,5 @@
+import { SKILL_TOOL_NAME } from "@sema-agent/core";
+export function answerGrantsBeyondCall(carrier) {
+    return Object.hasOwn(carrier, "boundGrantDigest") || carrier.toolName === SKILL_TOOL_NAME;
+}
+//# sourceMappingURL=standing-answer-grant.js.map

package/dist/task-settings.d.ts

@@ -11,10 +11,23 @@
  * operator/principal axis, [ref] §E6, a different trust axis + lifecycle). Re-applying on a resume leg is
  * idempotent (the same tighten), so no special resume handling is needed (mirrors runtime-governance).
  *
- * 🔒 SECURITY INVARIANTS (SDK settings.ts §3.3):
- *  - permissions are TIGHTEN-ONLY — folded via `tightenTaskSpec` (deny-wins `combinePolicies`); it THROWS on any
- *    override that would LOOSEN a stricter base safety field. The client can only ADD denies/asks/handsReadOnly on
- *    top of the deployment + operator baseline, never widen it.
+ * 🔒 SECURITY INVARIANTS (SDK settings.ts §3.3) —— **scope: the `settings.permissions` channel this module projects, and only it**:
+ *  - permissions are folded via `tightenTaskSpec` (deny-wins `combinePolicies`); it THROWS on any override that would
+ *    LOOSEN a stricter base safety field. Through THIS channel the client can ADD denies/asks/handsReadOnly on top of the
+ *    deployment + operator baseline, never widen it. Its `allow` rules (S-654 (c), 7.115.0) STATE an allow for the tools they name —
+ *    the answer core 7.40.0 wants before it runs an MCP / A2A call nobody stated — and never override a deny or an ask
+ *    from any layer (deny > ask > allow); a miss has no opinion. They release no ask a layer raises itself: on built-in
+ *    tools the engine's own write gate and shell checks still ask (unlike the reference implementation's `permissions.allow`).
+ *  - ⚠️ This is NOT a claim about the request as a whole. Since server 7.116.0 (core 7.41.0) a request-carried skill's
+ *    `allowedTools` — activated by the model's approved `Skill` card, or named in `userInvokedSkills` — IS an accepted
+ *    loosening on a different channel (`skills[]` → `TaskSpec.skills`, never through this module): for the rest of that run
+ *    it releases the `unstated` / `ordinary` asks the engine itself raises (including the built-in write gate and the shell's
+ *    ordinary asks; same predicate as a persisted allow rule), on hosted / multi-tenant deployments too — no deployment
+ *    switch, by ruling. It still clears no deny / ask rule (request or operator), no governance / shell-floor /
+ *    write-protection / plan-mode / probe / mandated ask, and opens no write containment. An operator who needs a person
+ *    asked for a given tool regardless uses the per-tool knobs: `APPROVAL_REQUIRE` (an ask rule), `APPROVAL_NEVER_AUTO`
+ *    (a person, mandated), `MANUAL_MODE_SHELL_GATE=always` (shell). Pinned on the real assembly:
+ *    `test/skill-grant-operator-knobs.test.ts`.
  *  - permissionMode(轴B #2 注释保鲜,1.254——[ref]/[ref] 后的真实现):`defaultMode` 收**五**模式
  *    (default | acceptEdits | plan | bypassPermissions | auto),bypass/auto 被 HONOR 为 gate-shape 选择
  *    ——但深层不变量未变:bypass=「不加 ask 门」,恒不越部署基线(tightenTaskSpec deny-wins,基线 deny/
@@ -224,8 +237,6 @@ export interface ParseTaskSettingsResult {
  *  posture (an uncapped prompt body is a per-turn token-cost hole; cross review). Exported so the HTTP layer
  *  (prepareSpec) can 400 fail-loud on submit with the SAME bound this defensive parse enforces on every path. */
 export declare const MAX_SETTINGS_OUTPUT_STYLE_CHARS = 16384;
-/** Cap on the element count of each permission list (allow/deny/ask) — bounds a pathological rule blast. */
-export declare const MAX_SETTINGS_PERMISSION_RULES = 1000;
 /** Caps on `settings.env` — bound a pathological env blast (count + per-value length; values land in the shell env). */
 export declare const MAX_SETTINGS_ENV_VARS = 256;
 export declare const MAX_SETTINGS_ENV_VALUE_CHARS = 32768;

package/dist/task-settings.js

@@ -1,6 +1,6 @@
-import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createPermissionRulePolicy, parseRuleText, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, ruleToolGrammarOf, } from "@sema-agent/core";
-import { findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
-import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { combinePolicies, createFsWriteGatePolicy, parseRuleText, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, ruleToolGrammarOf, } from "@sema-agent/core";
+import { unmatchableToolNamesRefusal } from "./config.js";
+import { MAX_PERMISSION_RULES_PER_LIST, createRuleListPolicy } from "./permission-rule-list.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 import { heldRuleName } from "./tool-rule-names.js";
@@ -61,7 +61,6 @@ export function skillListingMaxDescOk(v) {
     return typeof v === "number" && Number.isSafeInteger(v) && v > 0;
 }
 export const MAX_SETTINGS_OUTPUT_STYLE_CHARS = 16_384;
-export const MAX_SETTINGS_PERMISSION_RULES = 1_000;
 export const MAX_SETTINGS_ENV_VARS = 256;
 export const MAX_SETTINGS_ENV_VALUE_CHARS = 32_768;
 export const MAX_SETTINGS_ENV_KEY_CHARS = 256;
@@ -106,8 +105,8 @@ export function settingsPermissionBucketIssue(perms) {
         let fields;
         if (!Array.isArray(v))
             fields = { field, reason: "bad_entry" };
-        else if (v.length > MAX_SETTINGS_PERMISSION_RULES)
-            fields = { field, reason: "over_cap", count: v.length, cap: MAX_SETTINGS_PERMISSION_RULES };
+        else if (v.length > MAX_PERMISSION_RULES_PER_LIST)
+            fields = { field, reason: "over_cap", count: v.length, cap: MAX_PERMISSION_RULES_PER_LIST };
         else {
             const index = v.findIndex((x) => typeof x !== "string" || x.length === 0);
             if (index >= 0)
@@ -266,20 +265,7 @@ export function acceptAppendSystemPrompt(v, warn, packDropsAppend) {
     }
     return v;
 }
-const RULE_SOURCE_BY_BEHAVIOR = { ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
-function createRuleListPolicy(names, behavior, pathBases) {
-    try {
-        return createPermissionRulePolicy(names.map((name) => ({ rule: name, behavior, source: RULE_SOURCE_BY_BEHAVIOR[behavior] })), {
-            defaultAction: "allow",
-            caps: { maxRules: MAX_SETTINGS_PERMISSION_RULES },
-            ...(pathBases !== undefined ? { pathBases } : {}),
-        });
-    }
-    catch (e) {
-        const coreMsg = (e instanceof Error ? e.message : String(e)).replace(CONTROL_AND_BIDI_STRIP_RE, "");
-        throw new Error(`${RULE_SOURCE_BY_BEHAVIOR[behavior].replace("settings.", "")} has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
-    }
-}
+const RULE_SOURCE_BY_BEHAVIOR = { allow: "settings.permissions.allow", ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
 const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];
 const isWorkflowName = (name) => name === RUN_WORKFLOW_TOOL_NAME;
 function createWorkflowAskPolicy(isExempt) {
@@ -327,16 +313,16 @@ function rejectUnmatchableSettingsNames(perms, pathBases) {
             }
         }
     }
-    for (const [field, names, behavior, consumer] of [
-        ["permissions.ask", perms.ask, "ask", "rule-policy"],
-        ["permissions.deny", perms.deny, "deny", "rule-policy"],
-        ["permissions.allow", perms.allow, "allow", "tool-name-table"],
+    for (const [field, names, behavior] of [
+        ["permissions.ask", perms.ask, "ask"],
+        ["permissions.deny", perms.deny, "deny"],
+        ["permissions.allow", perms.allow, "allow"],
     ]) {
         if (!names)
             continue;
-        const bad = findUnmatchableToolNames(names, { consumer, behavior, ...(pathBases !== undefined ? { pathBases } : {}) });
-        if (bad.length > 0)
-            throw new Error(formatUnmatchableToolNames(field, bad));
+        const unmatchable = unmatchableToolNamesRefusal(field, names, { consumer: "rule-policy", behavior, ...(pathBases !== undefined ? { pathBases } : {}) });
+        if (unmatchable !== undefined)
+            throw new Error(unmatchable.message);
     }
 }
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
@@ -350,11 +336,11 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
     rejectUnmatchableSettingsNames(perms, pathBases);
     const policies = [];
     if (allow)
-        policies.push(createAllowDenyPolicy({ allow }));
+        policies.push(createRuleListPolicy(allow, "allow", RULE_SOURCE_BY_BEHAVIOR.allow, pathBases));
     if (deny)
-        policies.push(createRuleListPolicy(deny, "deny", pathBases));
+        policies.push(createRuleListPolicy(deny, "deny", RULE_SOURCE_BY_BEHAVIOR.deny, pathBases));
     if (ask)
-        policies.push(createRuleListPolicy(ask, "ask", pathBases));
+        policies.push(createRuleListPolicy(ask, "ask", RULE_SOURCE_BY_BEHAVIOR.ask, pathBases));
     const fsWriteGate = (acceptCwd) => {
         if (!gate)
             return undefined;

package/dist/tool-approval.d.ts

@@ -95,6 +95,10 @@ export interface StandingAnswerFacts {
     readonly requiresRealApproval: boolean;
     /** core 闸站盖的强制位([ref]):规则清不掉、站着的答案退不掉,只有对**这一次调用**的应答能答。 */
     readonly mandated: boolean;
+    /** 7.116.0(审计修复批 S4,core 7.41.0 `Skill` 卡):这一问的应答**还授予**这一次调用之外的东西(批准 `Skill` = 激活技能 + 本 run 内
+     *  清单免问)。站着的答案要代答它必须读得出授予绑定、且绑定相同;core 7.41.0 在活的问上不给绑定 ⇒ 两侧都读不出 ⇒ 不可记、不被代答。
+     *  读者一律经 `standing-answer-grant.ts` 的 `answerGrantsBeyondCall`(唯一读口)折这一位。 */
+    readonly grantsBeyondCall: boolean;
 }
 /**
  * 🔴 **S-660 —— 会话级放行的唯一判据:站着的答案能不能退掉这一问。** 纯谓词,三个读者:
@@ -245,6 +249,15 @@ export interface ToolApprovalFrame {
      * 席照常答得了」说的是**这一次调用的应答者**,本仓不改它。
      */
     mandated?: true;
+    /**
+     * **7.116.0(审计修复批 S4;ADDITIVE,`"tool_approval"` only)—— 这张卡上的「本会话放行」只放行这一次、不会被记住。**
+     * 值 = 同一只判据 {@link standingAnswerMayRetire} 的否定(四位:治理强制 / 必须真人 / 强制 / 应答还授予别的东西),回决侧写授权
+     * (`finishRespond`)读的是同一份事实 ⇒ 帧说不可记 ⇔ 点了 `allow_session` 回执 `rememberApplied:false`。壳读这一位决定渲不渲
+     * 「本会话放行」,不再从 `requiresRealApproval` / `mandated` / `governanceForced` 三位自己推断(那一推断漏掉第四个理由:core 7.41.0
+     * 的 `Skill` 卡批准即授予清单,三位全无)。`card_json` 卡面、`livePending` 行、运维队列行同名同义。
+     * 🔴 **真才带,缺席绝不编 `false`**:缺席 = 可记(有会话时)或老服务端。没有会话的腿上点了照样只放行一次(回执说明),本位不管那一形。
+     */
+    rememberRefused?: true;
     /**
      * **S-721(core 7.32.0 #1092;ADDITIVE,`"tool_approval"` only)** —— 强制位**站在哪一个词上**:core `PERSISTED_RULE_MANDATES`
      * 六词之一(`operator_always` / `tool_marks` / `probe_mandate` / `probe_unanswered` / `write_protection` /
@@ -452,10 +465,7 @@ export interface ToolApprovalFrame {
      * 耐久路的对偶 = `gate.riskDescriptor.probeCause`(同值,core `buildRiskDescriptor` 铸),走 checkpoint
      * 行的**整体透传**到 `GET /v1/approvals` —— 键集零施工,钉在同一个文件的 §4。
      *
-     * 姊妹键 `AskRequest.probeReason`(同一件事的**散文**兄弟)**今天不投影**:它与本键是同一个事实的两种
-     * 拼法,而 core 的边界哲学(交 code + 数组、不交句子)与「一张卡上不放两份同义解释」都指向只投结构化
-     * 那一份;散文那份还无法被消费端本地化。照 `preview` / `requiresRealApproval` 先例 = 候消费端(cli)
-     * 提渲染需求再翻(登记在 `trace/core-keyset-guard.ts` 的 EXCLUDED 栏)。
+     * 姊妹键 `probeReason`(同一件事的**散文**兄弟)见下一键 —— 7.115.0 起投影(S-733),与本键**并列不替代**。
      */
     probeCause?: {
         code: string;
@@ -468,6 +478,21 @@ export interface ToolApprovalFrame {
             total: number;
         };
     };
+    /**
+     * S-733(7.115.0;**ADDITIVE**,`"tool_approval"` only)—— 这次 ask 被收紧时探针给出的那一句**散文**因由
+     * (`AskRequest.probeReason`:core 在 maybe 档收紧点 `inlineUntrusted(…, 200)` 过的一句话)。与
+     * {@link probeCause}(结构化因由)**并列、不替代**:引擎自己铸的因由走结构位,**部署自写的探针**只会写这一句
+     * —— 一只只给 reason 不给 cause 的探针,此前其审批人在活卡上读不到任何因由(耐久面
+     * `gate.riskDescriptor.probeReason` 早就带着这同一句,两张脸只有一张有话说)。
+     *
+     * 🔴 **在场才带**(缺席绝不编空串;缺席 ≠「没有原因」);窄读单点 = `approval-card.ts` 的 `readProbeReason`
+     * (非串 / 空白 ⇒ 缺席;超信封 ⇒ **整只丢不截**;内容族 ⇒ 脱敏,与耐久面同一规则 ⇒ 对同一句话两面同值)。
+     * 🔴 **只在本帧上**:呈卡帧 / `card_json` 不携它(`ApprovalCardSchema` 是 `.strict()` 的耐久信封,加键要另行裁定)。
+     * 🔴 **展示 / 分诊元数据,永不是裁决输入**;永不进 `message`(那是分类器 / 模型的输入面)。
+     * `\p{Cf}` 展示重排类字符(方向 / 零宽标记):core 在这个座上**不剥**(同值契约下 core 自己披露的残余,[ref]);本仓脱敏器
+     * (`redactSecrets`)入口剥全部 `\p{Cf}`(7.70.0 起),活卡帧与耐久面**都过它** ⇒ 两面同值、且都是剥后字节(`test/approval-probe-reason-wire.test.ts` 钉)。
+     */
+    probeReason?: string;
     /**
      * [ref] 件 G2(core 5.35.0 [ref] G-2;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 背后的
      * **规则出处证据**(`AskRequest.ruleEvidence`,引擎在 gate 内盖章):org 快照 `orgRevision` / 命中的
@@ -539,6 +564,9 @@ export interface LivePendingRow {
      *  值 = 条目上那一位(`askBroadcast` 铸条目时取自这一次过闸的 `req.mandated`,与 {@link frame} 上的同名键同源)。此前只在
      *  `frame` 里:同一个 `GET /v1/approvals` 响应的 durable `pending[]` 行顶层带它(S-663 二段),live 行却要进帧里读。 */
     mandated?: true;
+    /** 7.116.0(审计修复批 S4):这张卡上的「本会话放行」不会被记住 —— 与 {@link ToolApprovalFrame.rememberRefused} 同名同义同源
+     *  (同一只判据,读条目上的四位事实);真才带。 */
+    rememberRefused?: true;
     /** S-721(core 7.32.0 #1092):强制位站在哪一个词上 —— 与 `mandated` 同层同形(在场逐字,缺席不编词),值 = 条目上那一个词
      *  (与 {@link frame} 上同名键同源;帧型该键顶注是全文)。 */
     mandate?: PersistedRuleMandate;

package/dist/tool-approval.js

@@ -8,11 +8,12 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { MAX_SETTLED_BY_CHARS, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, settledByFitsColumn } from "./plugins/approval-ask-store-sql.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 import { governanceOriginOf } from "./runtime-governance.js";
+import { answerGrantsBeyondCall } from "./standing-answer-grant.js";
 const defaultLogger = createLogger();
 export const APPROVAL_GATE_KINDS = ["human", "irreversible_ask"];
 export function isApprovalGateKind(k) {
@@ -84,7 +85,7 @@ function sessionAllowKey(owner, sessionId, category) {
     return JSON.stringify([owner, sessionId, category]);
 }
 export function standingAnswerMayRetire(facts) {
-    return !facts.governanceForced && !facts.requiresRealApproval && !facts.mandated;
+    return !facts.governanceForced && !facts.requiresRealApproval && !facts.mandated && !facts.grantsBeyondCall;
 }
 export function parkRowStandingAnswerFacts(pending, gate, governance) {
     const riskDescriptor = "riskDescriptor" in gate ? gate.riskDescriptor : undefined;
@@ -92,6 +93,15 @@ export function parkRowStandingAnswerFacts(pending, gate, governance) {
         governanceForced: governanceOriginOf({ riskDescriptor }, governance) === true,
         requiresRealApproval: readParkRowTrueSeat(pending, "requiresRealApproval"),
         mandated: readParkRowTrueSeat(pending, "mandated") || mandatedFromSeat(readRuleOffersAbsenceSeat(pending)),
+        grantsBeyondCall: answerGrantsBeyondCall(pending),
+    };
+}
+function pendingEntryStandingAnswerFacts(entry) {
+    return {
+        governanceForced: entry.governanceForced === true,
+        requiresRealApproval: entry.requiresRealApproval === true,
+        mandated: entry.mandated === true,
+        grantsBeyondCall: answerGrantsBeyondCall(entry),
     };
 }
 function mandatedFromSeat(seat) {
@@ -741,7 +751,7 @@ export class ToolApprovalCoordinator {
         return (this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(origin.owner, origin.sessionId, origin.taskId))).isMarked(req.toolCallId);
     }
     async standingGrantSettles(origin, req, governanceForced) {
-        if (!standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true }))
+        if (!standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true, grantsBeyondCall: answerGrantsBeyondCall(req) }))
             return false;
         const sessionId = origin.sessionId;
         if (!sessionId)
@@ -1088,6 +1098,7 @@ export class ToolApprovalCoordinator {
             ...(governanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(req.mandated === true ? { mandated: true } : {}),
+            ...(standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true, grantsBeyondCall: answerGrantsBeyondCall(req) }) ? {} : { rememberRefused: true }),
             ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
             ...(originWord !== undefined ? { origin: originWord } : {}),
             ...(askClassPair ?? {}),
@@ -1099,6 +1110,7 @@ export class ToolApprovalCoordinator {
             ...((f) => (f !== undefined ? { denialLimitFallback: f } : {}))(readDenialLimitFallback(req)),
             ...((g) => (g !== undefined ? { readRootCandidate: g } : {}))(readReadRootCandidate(req)),
             ...((c) => (c !== undefined ? { probeCause: c } : {}))(readProbeCause(req)),
+            ...((r) => (r !== undefined ? { probeReason: r } : {}))(readProbeReason(req)),
             ...((c) => (c !== undefined ? { ruleEvidence: c } : {}))(readRuleEvidence(req)),
             ...(bounded.omitted ? { argsOmitted: true } : { args: bounded.args }),
             ...(bounded.hasBidi || req.hasBidiControls === true ? { inputHasBidi: true } : {}),
@@ -1613,6 +1625,20 @@ export class ToolApprovalCoordinator {
                 return shapeOutcome(await allowedP);
             }
         }
+        const rememberRefused = !standingAnswerMayRetire(pendingEntryStandingAnswerFacts({
+            ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
+            ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+            ...(req.mandated === true ? { mandated: true } : {}),
+            toolName: req.toolName,
+        }));
+        if (rememberRefused)
+            frame.rememberRefused = true;
+        else
+            delete frame.rememberRefused;
+        if (cardForFrame !== undefined && (cardForFrame.rememberRefused === true) !== rememberRefused) {
+            const { rememberRefused: _stale, ...cardRest } = cardForFrame;
+            cardForFrame = rememberRefused ? { ...cardRest, rememberRefused: true } : cardRest;
+        }
         const pendingEntry = {
             settle,
             forceParkNow,
@@ -2211,11 +2237,7 @@ export class ToolApprovalCoordinator {
     }
     finishRespond(id, entry, parsed, opts) {
         let rememberApplied;
-        const grantable = standingAnswerMayRetire({
-            governanceForced: entry.governanceForced === true,
-            requiresRealApproval: entry.requiresRealApproval === true,
-            mandated: entry.mandated === true,
-        });
+        const grantable = standingAnswerMayRetire(pendingEntryStandingAnswerFacts(entry));
         if (parsed.value === "allow_session")
             rememberApplied = Boolean(entry.sessionId) && grantable;
         if (parsed.value === "allow_session" && entry.sessionId && grantable) {
@@ -2259,6 +2281,7 @@ export class ToolApprovalCoordinator {
                 ...(e.requiresRealApproval ? { requiresRealApproval: true } : {}),
                 ...(e.governanceForced ? { governanceForced: true } : {}),
                 ...(e.mandated ? { mandated: true } : {}),
+                ...(standingAnswerMayRetire(pendingEntryStandingAnswerFacts(e)) ? {} : { rememberRefused: true }),
                 ...(e.mandate !== undefined ? { mandate: e.mandate } : {}),
                 ...(e.origin !== undefined ? { origin: e.origin } : {}),
                 ...(e.originTaskId !== undefined ? { fromSubagent: true, originTaskId: e.originTaskId } : {}),

package/dist/trace/core-keyset-guard.d.ts

@@ -43,11 +43,11 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes";
-type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes";
+type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
-type AskFrameServerMinted = "type" | "approvalId" | "argsOmitted" | "outcome" | "governanceForced" | "expiresAtMs" | "expiresInMs" | "serverNowMs" | "parked" | "inputHasBidi";
+type AskFrameServerMinted = "type" | "approvalId" | "argsOmitted" | "outcome" | "governanceForced" | "expiresAtMs" | "expiresInMs" | "serverNowMs" | "parked" | "inputHasBidi" | "rememberRefused";
 type _GuardAskFrame = AssertAllKeysHandled<Exclude<keyof ToolApprovalFrame, AskProjected | AskFrameServerMinted>>;
 type _GuardAskFrameReverse = AssertAllKeysHandled<Exclude<AskProjected | AskFrameServerMinted, keyof ToolApprovalFrame>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta" | "tool_progress" | "tool_disclosure";
@@ -88,10 +88,13 @@ type _GuardWiringSessionReverse = AssertAllKeysHandled<Exclude<WiringSessionHand
 type WiringToolsHandled = "schemaVersion" | "count" | "entries" | "digest";
 type _GuardWiringTools = AssertAllKeysHandled<Exclude<keyof WiringSection<"tools">, WiringToolsHandled>>;
 type _GuardWiringToolsReverse = AssertAllKeysHandled<Exclude<WiringToolsHandled, keyof WiringSection<"tools">>>;
-type FleetExcluded = "subagentTranscripts";
-type WiringFleetHandled = "backgroundAgentStore" | "hostChildEventSink" | FleetExcluded;
+type WiringFleetHandled = "backgroundAgentStore" | "hostChildEventSink" | "subagentTranscripts";
 type _GuardWiringFleet = AssertAllKeysHandled<Exclude<keyof WiringSection<"fleet">, WiringFleetHandled>>;
 type _GuardWiringFleetReverse = AssertAllKeysHandled<Exclude<WiringFleetHandled, keyof WiringSection<"fleet">>>;
+type SubagentTranscriptTier = WiringSection<"fleet">["subagentTranscripts"];
+type SubagentTranscriptTierWords = "none" | "rows" | "full";
+type _GuardSubagentTranscriptTierWords = AssertAllKeysHandled<Exclude<SubagentTranscriptTier, SubagentTranscriptTierWords>>;
+type _GuardSubagentTranscriptTierWordsReverse = AssertAllKeysHandled<Exclude<SubagentTranscriptTierWords, SubagentTranscriptTier>>;
 type WiringMcpEntry = WiringSection<"mcp">[number];
 type WiringMcpExcluded = "error";
 type WiringMcpHandled = "name" | "source" | "status" | "errorCode" | "delivered" | "httpStatus" | "toolCount" | "liveness" | WiringMcpExcluded;
@@ -126,7 +129,7 @@ type WiringGovernanceHandled = "audience" | "lockedConfig" | "compliance" | "mem
 type _GuardWiringGovernance = AssertAllKeysHandled<Exclude<keyof WiringSection<"governance">, WiringGovernanceHandled>>;
 type _GuardWiringGovernanceReverse = AssertAllKeysHandled<Exclude<WiringGovernanceHandled, keyof WiringSection<"governance">>>;
 type PermissionTraceKind = Extract<TraceEvent["kind"], `permission.${string}`>;
-export type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed";
+export type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed" | "permission.skill_allowed";
 type PermissionTraceDropped = "permission.sandbox_admitted" | "permission.rule_sync_resurrected" | "permission.rule_sync_dropped" | "permission.org_snapshot_unavailable";
 type _GuardPermissionTrace = AssertAllKeysHandled<Exclude<PermissionTraceKind, PermissionTraceProjected | PermissionTraceDropped>>;
 type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTraceProjected | PermissionTraceDropped, PermissionTraceKind>>;
@@ -141,11 +144,11 @@ type ParkArmKeys = keyof Extract<PendingAction, {
     kind: "tool_approval";
 }>;
 type ParkArmQueueProjected = "toolName" | "toolCallId" | "boundInputHash" | "ruleOffers" | "hasBidiControls" | keyof import("../approval-card.js").ParkRowFacts;
-type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy";
+type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "boundGrantDigest";
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills";
 type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "outputStyle";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
@@ -288,6 +291,8 @@ export type CoreKeysetGuards = [
     _GuardWiringToolsReverse,
     _GuardWiringFleet,
     _GuardWiringFleetReverse,
+    _GuardSubagentTranscriptTierWords,
+    _GuardSubagentTranscriptTierWordsReverse,
     _GuardWiringMcp,
     _GuardWiringMcpReverse,
     _GuardWiringRules,

package/dist/trace/project.js

@@ -499,9 +499,18 @@ export function wiringManifestEventData(ev, instructions) {
         ...(Array.isArray(parkIn.reasons) ? { reasons: parkIn.reasons.filter((r) => typeof r === "string") } : {}),
         ...(str(parkIn.checkpointDurability) !== undefined ? { checkpointDurability: parkIn.checkpointDurability } : {}),
     });
+    const subagentTranscripts = (() => {
+        if (fleetIn.subagentTranscripts === undefined)
+            return undefined;
+        const word = str(fleetIn.subagentTranscripts);
+        if (word === undefined)
+            return dropProjectedFace("wiring_manifest.fleet.subagentTranscripts is not a non-empty string");
+        return word;
+    })();
     const fleet = nonEmpty({
         ...(bool(fleetIn.backgroundAgentStore) !== undefined ? { backgroundAgentStore: fleetIn.backgroundAgentStore } : {}),
         ...(bool(fleetIn.hostChildEventSink) !== undefined ? { hostChildEventSink: fleetIn.hostChildEventSink } : {}),
+        ...(subagentTranscripts !== undefined ? { subagentTranscripts } : {}),
     });
     const permissionRules = nonEmpty({
         ...(bool(rulesIn.storeWired) !== undefined ? { storeWired: rulesIn.storeWired } : {}),

package/dist/trace/self-minted-wire.d.ts

@@ -113,6 +113,48 @@ export declare const SELF_MINTED_WIRE: {
             };
         };
     };
+    /**
+     * 审批问的**无人决终态归因**:`POST /v1/tasks/:taskId/asks/:askId/decision` 410 `gone.ask` 体的 `deniedReason`(问账行 `denied_reason` 列原值)。
+     * 词表属主 = `approval-deny-reasons.ts` 的 `DENY_REASONS` ∪ `VOID_REASONS`(`satisfies Record<DenyReason | VoidReason, …>`:表加词而本行没跟 ⇒ tsc 红)。
+     * 7.116.0 +2:启动收敛(承载它的进程没了)的两个词 —— 与 `crashConvergedCause` 同词(同一问在两个读面上一个成因)。
+     */
+    readonly askTerminalReason: {
+        readonly at: "POST /v1/tasks/:taskId/asks/:askId/decision 410 gone.ask deniedReason";
+        readonly members: {
+            routing_failure_fail_closed: {
+                attr: string;
+                since: string;
+            };
+            run_cancelled: {
+                attr: string;
+                since: string;
+            };
+            batch_aborted: {
+                attr: string;
+                since: string;
+            };
+            batch_bound_elsewhere: {
+                attr: string;
+                since: string;
+            };
+            adhoc_leg_no_durable_domain: {
+                attr: string;
+                since: string;
+            };
+            orphan_ttl_exceeded: {
+                attr: string;
+                since: string;
+            };
+            crashed_before_park: {
+                attr: string;
+                since: string;
+            };
+            shutdown_before_park: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
     /** 本仓在出口对 core 值做的变换(值变、键不变)。 */
     readonly wireValueRule: {
         readonly at: "出口值变换(<端点>#<键> → 变换)";

package/dist/trace/self-minted-wire.js

@@ -40,6 +40,19 @@ export const SELF_MINTED_WIRE = {
             "internal.memory_control_plane_corrupt": { attr: 500, since: "7.108.0" },
         },
     },
+    askTerminalReason: {
+        at: "POST /v1/tasks/:taskId/asks/:askId/decision 410 gone.ask deniedReason",
+        members: {
+            routing_failure_fail_closed: { attr: "-", since: "7.3.0" },
+            run_cancelled: { attr: "-", since: "7.3.0" },
+            batch_aborted: { attr: "-", since: "7.3.0" },
+            batch_bound_elsewhere: { attr: "-", since: "7.3.0" },
+            adhoc_leg_no_durable_domain: { attr: "-", since: "7.3.0" },
+            orphan_ttl_exceeded: { attr: "-", since: "7.3.0" },
+            crashed_before_park: { attr: "-", since: "7.116.0" },
+            shutdown_before_park: { attr: "-", since: "7.116.0" },
+        },
+    },
     wireValueRule: {
         at: "出口值变换(<端点>#<键> → 变换)",
         members: {