@sema-agent/server 7.115.0 → 7.116.1

package/dist/session-policy-wire.js

@@ -1,21 +1,41 @@
-import { PROTOCOL_TABLE, RETIRED_TOOL_NAMES, protocolOf } from "@sema-agent/core";
-const RULE_FIELD_ROLE = {
-    toolAllow: "tool-name",
-    toolDeny: "tool-name",
-    allowDirs: "path",
-    commandAllow: "command",
-    commandDeny: "command",
+import { PROTOCOL_TABLE, SessionPolicyError, assertSessionRuleNamesCurrent, judgeRuleToolName } from "@sema-agent/core";
+import { describeUnreachableNamespacedRuleName, unreachableNamespacedRuleNameOf } from "./namespaced-rule-name.js";
+const RULE_FIELDS = {
+    toolAllow: true,
+    toolDeny: true,
+    allowDirs: true,
+    commandAllow: true,
+    commandDeny: true,
 };
-export const SESSION_PERMISSION_RULE_FIELDS = Object.keys(RULE_FIELD_ROLE);
-const TOOL_NAME_RULE_FIELDS = SESSION_PERMISSION_RULE_FIELDS.filter((f) => RULE_FIELD_ROLE[f] === "tool-name");
-export function legacyToolNameOf(name) {
-    const guidance = RETIRED_TOOL_NAMES.get(name);
-    if (guidance !== undefined)
-        return { why: "retired", guidance };
-    if (name.includes("__") && protocolOf(name) === undefined)
-        return { why: "unprefixed-namespace" };
+export const SESSION_PERMISSION_RULE_FIELDS = Object.keys(RULE_FIELDS);
+function legacyToolNameRefusalOf(rules) {
+    try {
+        assertSessionRuleNamesCurrent(rules);
+        return undefined;
+    }
+    catch (e) {
+        if (e instanceof SessionPolicyError && e.code === "legacy_tool_name" && e.detail !== undefined)
+            return e.detail;
+        throw e;
+    }
+}
+const TOOL_NAME_FIELD_TABLE = { toolAllow: "toolAllow", toolDeny: "toolDeny" };
+const TOOL_NAME_FIELDS = Object.values(TOOL_NAME_FIELD_TABLE);
+export function unreachableSessionRuleNameOf(rules) {
+    for (const field of TOOL_NAME_FIELDS) {
+        for (const name of rules[field] ?? []) {
+            const verdict = unreachableNamespacedRuleNameOf(name);
+            if (verdict !== undefined)
+                return { field, name, verdict };
+        }
+    }
     return undefined;
 }
+export function assertSessionRuleNamesReachable(rules) {
+    const unreachable = unreachableSessionRuleNameOf(rules);
+    if (unreachable !== undefined)
+        throw new Error(describeUnreachableSessionRuleName(unreachable));
+}
 function protocolToolNameShapes() {
     return PROTOCOL_TABLE.map((ns) => `${ns.prefix}<peer>__<tool>`).join(" or ");
 }
@@ -38,13 +58,12 @@ export function readWritableSessionPermissionRules(raw) {
     const read = readSessionPermissionRules(raw);
     if (read.problem !== undefined)
         return read;
-    for (const field of TOOL_NAME_RULE_FIELDS) {
-        for (const name of read.rules[field] ?? []) {
-            const legacy = legacyToolNameOf(name);
-            if (legacy !== undefined)
-                return { problem: { kind: "legacy-tool-name", field, name, legacy } };
-        }
-    }
+    const refusal = legacyToolNameRefusalOf(read.rules);
+    if (refusal !== undefined)
+        return { problem: { kind: "legacy-tool-name", refusal } };
+    const unreachable = unreachableSessionRuleNameOf(read.rules);
+    if (unreachable !== undefined)
+        return { problem: { kind: "unreachable-tool-name", unreachable } };
     return read;
 }
 export function readSessionRulesRecords(raw) {
@@ -71,22 +90,29 @@ export function describeSessionPermissionRulesProblem(p) {
     switch (p.kind) {
         case "not-an-object": return "rules must be a SessionPermissionRules object";
         case "field-not-string-array": return `${p.field} must be an array of strings`;
-        case "legacy-tool-name": return describeLegacyToolName(p.field, p.name, p.legacy);
+        case "legacy-tool-name": return describeLegacyToolName(p.refusal);
+        case "unreachable-tool-name": return describeUnreachableSessionRuleName(p.unreachable);
         default: {
             const unhandled = p;
             throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);
         }
     }
 }
-function describeLegacyToolName(field, name, legacy) {
-    switch (legacy.why) {
-        case "retired":
-            return `${field} names "${name}", a retired tool name (${legacy.guidance}); with that rule in place this session could not start another run, so nothing was written — use the current tool name`;
-        case "unprefixed-namespace":
-            return `${field} names "${name}", which contains "__" but no protocol prefix; with that rule in place this session could not start another run, so nothing was written — a protocol tool is named ${protocolToolNameShapes()}`;
+function describeUnreachableSessionRuleName(u) {
+    return `${u.field} names "${u.name}", which can never match a tool (${describeUnreachableNamespacedRuleName(u.verdict)}), so nothing was written`;
+}
+function describeLegacyToolName(r) {
+    switch (r.verdict) {
+        case "retired": {
+            const v = judgeRuleToolName(r.name, new Set());
+            const guidance = v.kind === "retired" ? v.guidance : `renamed "${r.currentName ?? "?"}"`;
+            return `${r.field} names "${r.name}", a retired tool name (${guidance}); with that rule in place this session could not start another run, so nothing was written — use the current tool name${r.currentName !== undefined ? ` ("${r.currentName}")` : ""}`;
+        }
+        case "unprefixed_namespace":
+            return `${r.field} names "${r.name}", which contains "__" but no protocol prefix; with that rule in place this session could not start another run, so nothing was written — a protocol tool is named ${protocolToolNameShapes()}`;
         default: {
-            const unhandled = legacy;
-            throw new Error(`unhandled legacy tool name arm: ${JSON.stringify(unhandled)}`);
+            const unhandled = r.verdict;
+            throw new Error(`unhandled legacy tool name verdict: ${JSON.stringify(unhandled)}`);
         }
     }
 }
@@ -100,9 +126,10 @@ export function legacyToolNameProblemOf(p) {
             switch (p.problem.kind) {
                 case "not-an-object":
                 case "field-not-string-array":
+                case "unreachable-tool-name":
                     return undefined;
                 case "legacy-tool-name":
-                    return { field: p.problem.field, name: p.problem.name };
+                    return p.problem.refusal;
                 default: {
                     const unhandled = p.problem;
                     throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);
@@ -131,6 +158,7 @@ export function sessionPolicyErrorHttp(code) {
         case "conflict": return { status: 409, errorCode: "conflict" };
         case "loosen_forbidden": return { status: 403, errorCode: "loosen_forbidden" };
         case "corrupt": return { status: 500, errorCode: "corrupt" };
+        case "legacy_tool_name": return { status: 400, errorCode: "rules.legacy_tool_name" };
         default: {
             const unhandled = code;
             throw new Error(`unhandled SessionPolicyError code: ${JSON.stringify(unhandled)}`);

package/dist/spec-fields.d.ts

@@ -4,6 +4,7 @@
  * body WITHOUT the HTTP-layer 400 validation, so a malformed value must fall back to a safe default, never throw.
  */
 import { type AgentDefinition, type TaskSpec } from "@sema-agent/core";
+import { type UnreachableNamespacedRuleName } from "./namespaced-rule-name.js";
 /**
  * E12 — normalize `body.suggestNextPrompts` → `TaskSpec.suggestNextPrompts`. `true` = on with core defaults
  * (count 3, cheap role); an object tunes `count` (clamped 1..10) / `role` (a free string — core validates it against
@@ -42,6 +43,36 @@ export declare function normalizeResumeAtMode(v: unknown, resumeAtResolved: bool
  *  (每个定义的 whenToUse/systemPrompt 都是无条件进系统提示的 prompt 载荷),与 [ref] 退役的
  *  **技能**条数帽不是同一轴:技能清单由引擎按预算渲染(超了裁描述),agent 定义没有那个预算面。 */
 export declare const MAX_TASK_AGENTS = 32;
+/**
+ * core 7.41.0 #1303 —— 技能的两只清单 `allowedTools` / `disallowedTools`(`dist/core/agent-definition.d.ts`:本次 run 的 allow 规则来源 /
+ * deny 规则来源,不是围栏)的**形**谓词。两道技能门(顶层 `body.skills[]` 的 `validateUserSkills`、`agents[].skills[]` 的
+ * {@link SKILL_FIELD_SHAPES})**同一只**:一边判一边不判 = 同一个键两种话(S-377 baseDir 吃过的亏)。
+ *
+ * 本谓词只判「字符串数组」:引擎 `compileSkillGrant` 直接 `for (const entry of list)` —— 一个裸字符串 `"Bash"` 会被逐字符迭代成
+ * `B` / `a` / `s` / `h` 四条(deny 侧 = 意图静默落空,安全轴上的放宽方向)。条目的**文法**不在受理面判:引擎在开跑时对读不出的条目
+ * (`*` / 写路径 / 域名)发 `skills.allowed_tool_not_granted`,文法的属主是引擎(directory loader 同样原样抄、不判)。
+ * 形对之后两道门再问一问 {@link unreachableSkillToolListEntryOf}(协议名的服务器段铸不出 / 缺段 ⇒ 400)—— 那一问不是文法,是「写得出却永远匹配不到」,
+ * 与配置表、会话规则写口同一只判官。
+ * 无条数 / 长度帽([ref]:技能面的受理帽整族退役,体积由 8 MiB 请求体上限兜)。
+ */
+export declare const skillToolListOk: (v: unknown) => boolean;
+/** 技能的两只清单(`allowedTools` = allow 规则来源,`disallowedTools` = deny 规则来源;条目的工具名那一段两只同读)。 */
+declare const SKILL_TOOL_LISTS: readonly ["allowedTools", "disallowedTools"];
+/** 技能清单里一条够不着任何挂载工具的协议名条目。 */
+export interface SkillToolListUnreachable {
+    readonly key: (typeof SKILL_TOOL_LISTS)[number];
+    readonly entry: string;
+    readonly verdict: UnreachableNamespacedRuleName;
+}
+/**
+ * 一条技能(形已过两道门的字符串数组判)的两只清单里,第一条「协议名写得出、却永远匹配不到」的条目 —— 判官是 `namespaced-rule-name.ts` 那一只
+ * (配置表 / 请求三桶 / 会话规则写口同调),条目的工具名那一段经同一只 `ruleEntryToolName` 取(与配置表的规则编译器消费者同读)。都够得着 ⇒ `undefined`。
+ * 两处受理口同调:顶层 `skills[]`(`http/admission.ts` 的 `validateUserSkills`)、子代 `agents[].skills[]`({@link validateTaskAgents})。
+ * 续跑重放**不问**这一问(两层都是:重放腿不过受理口,存量体照旧原样交给引擎 —— 引擎把它编成一条永不命中的规则,与修前同一种命运,不另开读法)。
+ */
+export declare function unreachableSkillToolListEntryOf(skill: Record<string, unknown>): SkillToolListUnreachable | undefined;
+/** 两处受理口同一句(句子的后半与配置表 / 会话规则写口同一只 `describeUnreachableNamespacedRuleName`)。 */
+export declare function describeUnreachableSkillToolListEntry(u: SkillToolListUnreachable): string;
 /** [ref] 单条 agent 定义的形状裁决:null=合法;否则一句可 400 的英文错误(不带索引,调用方自己加)。
  *  白名单外键 fail-loud —— 与 resilience/limits 的「容忍未知键」相反:agents 是能力定义,静默丢字段 =
  *  定义被悄悄削(一个丢掉的 isolation 就是放宽),比 400 更危险,故整条拒。⚠️ 已知残账(core 半场):
@@ -157,4 +188,5 @@ export declare function normalizeApproachNotice(raw: unknown): false | {
  * 全空 ⇒ undefined(spec 不挂 limits 键,byte-compat)。
  */
 export declare function resolveTaskLimits(bodyLimits: unknown, caps: TaskLimitCaps, envTimeoutSec: number, requirePrincipal: boolean | undefined, big: boolean, warn?: (event: string, fields: Record<string, unknown>) => void): TaskSpec["limits"];
+export {};
 //# sourceMappingURL=spec-fields.d.ts.map

package/dist/spec-fields.js

@@ -1,6 +1,7 @@
 import { isThinkingLevel } from "@sema-agent/core";
 import { taskWallClockSec } from "./task-workflow.js";
 import { isValidCwd } from "./task-cwd.js";
+import { describeUnreachableNamespacedRuleName, ruleEntryToolName, unreachableNamespacedRuleNameOf } from "./namespaced-rule-name.js";
 export function normalizeSuggestNextPrompts(v) {
     if (v === true)
         return true;
@@ -65,28 +66,34 @@ const toolList = (v) => Array.isArray(v) &&
     v.length <= MAX_AGENT_TOOLS &&
     v.every((x) => typeof x === "string" && x.length > 0 && x.length <= MAX_AGENT_TOOL_NAME_CHARS);
 const plainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-const skillManifestOk = (m) => {
-    if (!plainObject(m))
-        return false;
-    for (const k of Object.keys(m)) {
-        if (k !== "allowTools" && k !== "allowPaths" && k !== "egress" && k !== "lineageId")
-            return false;
+export const skillToolListOk = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+const SKILL_TOOL_LISTS = ["allowedTools", "disallowedTools"];
+export function unreachableSkillToolListEntryOf(skill) {
+    for (const key of SKILL_TOOL_LISTS) {
+        const list = skill[key];
+        if (!Array.isArray(list))
+            continue;
+        for (const entry of list) {
+            if (typeof entry !== "string")
+                continue;
+            const verdict = unreachableNamespacedRuleNameOf(ruleEntryToolName(entry));
+            if (verdict !== undefined)
+                return { key, entry, verdict };
+        }
     }
-    if (!(Array.isArray(m.allowTools) && m.allowTools.every((x) => typeof x === "string")))
-        return false;
-    if (m.allowPaths !== undefined && !(Array.isArray(m.allowPaths) && m.allowPaths.every((x) => typeof x === "string")))
-        return false;
-    if (m.egress !== undefined && typeof m.egress !== "boolean")
-        return false;
-    return typeof m.lineageId === "string" && m.lineageId.length > 0;
-};
+    return undefined;
+}
+export function describeUnreachableSkillToolListEntry(u) {
+    return `skill.${u.key} names "${u.entry}", which can never match a tool (${describeUnreachableNamespacedRuleName(u.verdict)})`;
+}
 const skillFilesOk = (v) => Array.isArray(v) &&
     v.every((f) => plainObject(f) && typeof f.path === "string" && f.path.length > 0 && typeof f.content === "string");
 const SKILL_FIELD_SHAPES = {
     name: { required: true, ok: (v) => typeof v === "string" && v.length > 0 },
     description: { required: true, ok: (v) => typeof v === "string" },
     content: { required: true, ok: (v) => typeof v === "string" && v.length > 0 && v.length <= MAX_AGENT_SKILL_CONTENT_CHARS },
-    manifest: { required: false, ok: skillManifestOk },
+    allowedTools: { required: false, ok: skillToolListOk },
+    disallowedTools: { required: false, ok: skillToolListOk },
     files: { required: false, ok: skillFilesOk },
     baseDir: { required: false, ok: isValidCwd },
 };
@@ -136,7 +143,7 @@ const TASK_AGENT_FIELD_SHAPES = {
     allowTools: { desc: `an array of at most ${MAX_AGENT_TOOLS} non-empty strings of at most ${MAX_AGENT_TOOL_NAME_CHARS} characters each`, ok: toolList },
     denyTools: { desc: `an array of at most ${MAX_AGENT_TOOLS} non-empty strings of at most ${MAX_AGENT_TOOL_NAME_CHARS} characters each`, ok: toolList },
     skills: {
-        desc: "an array of { name, description, content } skill objects (optional manifest/files/baseDir; files entries need { path, content }; baseDir must be an absolute path with no \"..\" segment) — no count cap; the engine renders the listing within its own byte budget",
+        desc: "an array of { name, description, content } skill objects (optional allowedTools/disallowedTools/files/baseDir; allowedTools/disallowedTools are arrays of strings; files entries need { path, content }; baseDir must be an absolute path with no \"..\" segment) — no count cap; the engine renders the listing within its own byte budget",
         ok: (v) => Array.isArray(v) && v.every(skillOk),
     },
     background: { desc: "a boolean", ok: (v) => typeof v === "boolean" },
@@ -187,6 +194,14 @@ export function validateTaskAgents(v) {
         const issue = taskAgentIssue(v[i]);
         if (issue)
             return `agents[${i}]: ${issue}`;
+        const skills = v[i].skills;
+        if (Array.isArray(skills)) {
+            for (let j = 0; j < skills.length; j++) {
+                const unreachable = unreachableSkillToolListEntryOf(skills[j]);
+                if (unreachable !== undefined)
+                    return `agents[${i}]: skills[${j}]: ${describeUnreachableSkillToolListEntry(unreachable)}`;
+            }
+        }
         const name = v[i].name;
         if (names.has(name))
             return `agents[${i}]: duplicate agent name "${name}"`;

package/dist/standing-answer-grant.d.ts

@@ -0,0 +1,8 @@
+/** 读口的入参:任何一种载着「这一问」的形(活的 `AskRequest`、`ToolCallRequest`、待决条目、停驻行的 `tool_approval` 臂)都结构上满足。 */
+export interface StandingAnswerGrantCarrier {
+    readonly toolName?: unknown;
+    readonly boundGrantDigest?: unknown;
+}
+/** 这一问的应答是否授予这一次调用之外的东西(读法见文件头注)。 */
+export declare function answerGrantsBeyondCall(carrier: StandingAnswerGrantCarrier): boolean;
+//# sourceMappingURL=standing-answer-grant.d.ts.map

package/dist/standing-answer-grant.js

@@ -0,0 +1,5 @@
+import { SKILL_TOOL_NAME } from "@sema-agent/core";
+export function answerGrantsBeyondCall(carrier) {
+    return Object.hasOwn(carrier, "boundGrantDigest") || carrier.toolName === SKILL_TOOL_NAME;
+}
+//# sourceMappingURL=standing-answer-grant.js.map

package/dist/task-settings.d.ts

@@ -11,13 +11,23 @@
  * operator/principal axis, [ref] §E6, a different trust axis + lifecycle). Re-applying on a resume leg is
  * idempotent (the same tighten), so no special resume handling is needed (mirrors runtime-governance).
  *
- * 🔒 SECURITY INVARIANTS (SDK settings.ts §3.3):
+ * 🔒 SECURITY INVARIANTS (SDK settings.ts §3.3) —— **scope: the `settings.permissions` channel this module projects, and only it**:
  *  - permissions are folded via `tightenTaskSpec` (deny-wins `combinePolicies`); it THROWS on any override that would
- *    LOOSEN a stricter base safety field. The client can ADD denies/asks/handsReadOnly on top of the deployment +
- *    operator baseline, never widen it. Its `allow` rules (S-654 (c), 7.115.0) STATE an allow for the tools they name —
+ *    LOOSEN a stricter base safety field. Through THIS channel the client can ADD denies/asks/handsReadOnly on top of the
+ *    deployment + operator baseline, never widen it. Its `allow` rules (S-654 (c), 7.115.0) STATE an allow for the tools they name —
  *    the answer core 7.40.0 wants before it runs an MCP / A2A call nobody stated — and never override a deny or an ask
  *    from any layer (deny > ask > allow); a miss has no opinion. They release no ask a layer raises itself: on built-in
  *    tools the engine's own write gate and shell checks still ask (unlike the reference implementation's `permissions.allow`).
+ *  - ⚠️ This is NOT a claim about the request as a whole. Since server 7.116.0 (core 7.41.0) a request-carried skill's
+ *    `allowedTools` — activated by the model's approved `Skill` card, or named in `userInvokedSkills` — IS an accepted
+ *    loosening on a different channel (`skills[]` → `TaskSpec.skills`, never through this module): for the rest of that run
+ *    it releases the `unstated` / `ordinary` asks the engine itself raises (including the built-in write gate and the shell's
+ *    ordinary asks; same predicate as a persisted allow rule), on hosted / multi-tenant deployments too — no deployment
+ *    switch, by ruling. It still clears no deny / ask rule (request or operator), no governance / shell-floor /
+ *    write-protection / plan-mode / probe / mandated ask, and opens no write containment. An operator who needs a person
+ *    asked for a given tool regardless uses the per-tool knobs: `APPROVAL_REQUIRE` (an ask rule), `APPROVAL_NEVER_AUTO`
+ *    (a person, mandated), `MANUAL_MODE_SHELL_GATE=always` (shell). Pinned on the real assembly:
+ *    `test/skill-grant-operator-knobs.test.ts`.
  *  - permissionMode(轴B #2 注释保鲜,1.254——[ref]/[ref] 后的真实现):`defaultMode` 收**五**模式
  *    (default | acceptEdits | plan | bypassPermissions | auto),bypass/auto 被 HONOR 为 gate-shape 选择
  *    ——但深层不变量未变:bypass=「不加 ask 门」,恒不越部署基线(tightenTaskSpec deny-wins,基线 deny/

package/dist/tool-approval.d.ts

@@ -95,6 +95,10 @@ export interface StandingAnswerFacts {
     readonly requiresRealApproval: boolean;
     /** core 闸站盖的强制位([ref]):规则清不掉、站着的答案退不掉,只有对**这一次调用**的应答能答。 */
     readonly mandated: boolean;
+    /** 7.116.0(审计修复批 S4,core 7.41.0 `Skill` 卡):这一问的应答**还授予**这一次调用之外的东西(批准 `Skill` = 激活技能 + 本 run 内
+     *  清单免问)。站着的答案要代答它必须读得出授予绑定、且绑定相同;core 7.41.0 在活的问上不给绑定 ⇒ 两侧都读不出 ⇒ 不可记、不被代答。
+     *  读者一律经 `standing-answer-grant.ts` 的 `answerGrantsBeyondCall`(唯一读口)折这一位。 */
+    readonly grantsBeyondCall: boolean;
 }
 /**
  * 🔴 **S-660 —— 会话级放行的唯一判据:站着的答案能不能退掉这一问。** 纯谓词,三个读者:
@@ -245,6 +249,15 @@ export interface ToolApprovalFrame {
      * 席照常答得了」说的是**这一次调用的应答者**,本仓不改它。
      */
     mandated?: true;
+    /**
+     * **7.116.0(审计修复批 S4;ADDITIVE,`"tool_approval"` only)—— 这张卡上的「本会话放行」只放行这一次、不会被记住。**
+     * 值 = 同一只判据 {@link standingAnswerMayRetire} 的否定(四位:治理强制 / 必须真人 / 强制 / 应答还授予别的东西),回决侧写授权
+     * (`finishRespond`)读的是同一份事实 ⇒ 帧说不可记 ⇔ 点了 `allow_session` 回执 `rememberApplied:false`。壳读这一位决定渲不渲
+     * 「本会话放行」,不再从 `requiresRealApproval` / `mandated` / `governanceForced` 三位自己推断(那一推断漏掉第四个理由:core 7.41.0
+     * 的 `Skill` 卡批准即授予清单,三位全无)。`card_json` 卡面、`livePending` 行、运维队列行同名同义。
+     * 🔴 **真才带,缺席绝不编 `false`**:缺席 = 可记(有会话时)或老服务端。没有会话的腿上点了照样只放行一次(回执说明),本位不管那一形。
+     */
+    rememberRefused?: true;
     /**
      * **S-721(core 7.32.0 #1092;ADDITIVE,`"tool_approval"` only)** —— 强制位**站在哪一个词上**:core `PERSISTED_RULE_MANDATES`
      * 六词之一(`operator_always` / `tool_marks` / `probe_mandate` / `probe_unanswered` / `write_protection` /
@@ -551,6 +564,9 @@ export interface LivePendingRow {
      *  值 = 条目上那一位(`askBroadcast` 铸条目时取自这一次过闸的 `req.mandated`,与 {@link frame} 上的同名键同源)。此前只在
      *  `frame` 里:同一个 `GET /v1/approvals` 响应的 durable `pending[]` 行顶层带它(S-663 二段),live 行却要进帧里读。 */
     mandated?: true;
+    /** 7.116.0(审计修复批 S4):这张卡上的「本会话放行」不会被记住 —— 与 {@link ToolApprovalFrame.rememberRefused} 同名同义同源
+     *  (同一只判据,读条目上的四位事实);真才带。 */
+    rememberRefused?: true;
     /** S-721(core 7.32.0 #1092):强制位站在哪一个词上 —— 与 `mandated` 同层同形(在场逐字,缺席不编词),值 = 条目上那一个词
      *  (与 {@link frame} 上同名键同源;帧型该键顶注是全文)。 */
     mandate?: PersistedRuleMandate;

package/dist/tool-approval.js

@@ -13,6 +13,7 @@ import { MAX_SETTLED_BY_CHARS, POLICY_REFUSAL_DECISION, projectAskTerminalClaimT
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 import { governanceOriginOf } from "./runtime-governance.js";
+import { answerGrantsBeyondCall } from "./standing-answer-grant.js";
 const defaultLogger = createLogger();
 export const APPROVAL_GATE_KINDS = ["human", "irreversible_ask"];
 export function isApprovalGateKind(k) {
@@ -84,7 +85,7 @@ function sessionAllowKey(owner, sessionId, category) {
     return JSON.stringify([owner, sessionId, category]);
 }
 export function standingAnswerMayRetire(facts) {
-    return !facts.governanceForced && !facts.requiresRealApproval && !facts.mandated;
+    return !facts.governanceForced && !facts.requiresRealApproval && !facts.mandated && !facts.grantsBeyondCall;
 }
 export function parkRowStandingAnswerFacts(pending, gate, governance) {
     const riskDescriptor = "riskDescriptor" in gate ? gate.riskDescriptor : undefined;
@@ -92,6 +93,15 @@ export function parkRowStandingAnswerFacts(pending, gate, governance) {
         governanceForced: governanceOriginOf({ riskDescriptor }, governance) === true,
         requiresRealApproval: readParkRowTrueSeat(pending, "requiresRealApproval"),
         mandated: readParkRowTrueSeat(pending, "mandated") || mandatedFromSeat(readRuleOffersAbsenceSeat(pending)),
+        grantsBeyondCall: answerGrantsBeyondCall(pending),
+    };
+}
+function pendingEntryStandingAnswerFacts(entry) {
+    return {
+        governanceForced: entry.governanceForced === true,
+        requiresRealApproval: entry.requiresRealApproval === true,
+        mandated: entry.mandated === true,
+        grantsBeyondCall: answerGrantsBeyondCall(entry),
     };
 }
 function mandatedFromSeat(seat) {
@@ -741,7 +751,7 @@ export class ToolApprovalCoordinator {
         return (this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(origin.owner, origin.sessionId, origin.taskId))).isMarked(req.toolCallId);
     }
     async standingGrantSettles(origin, req, governanceForced) {
-        if (!standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true }))
+        if (!standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true, grantsBeyondCall: answerGrantsBeyondCall(req) }))
             return false;
         const sessionId = origin.sessionId;
         if (!sessionId)
@@ -1088,6 +1098,7 @@ export class ToolApprovalCoordinator {
             ...(governanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(req.mandated === true ? { mandated: true } : {}),
+            ...(standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true, grantsBeyondCall: answerGrantsBeyondCall(req) }) ? {} : { rememberRefused: true }),
             ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
             ...(originWord !== undefined ? { origin: originWord } : {}),
             ...(askClassPair ?? {}),
@@ -1614,6 +1625,20 @@ export class ToolApprovalCoordinator {
                 return shapeOutcome(await allowedP);
             }
         }
+        const rememberRefused = !standingAnswerMayRetire(pendingEntryStandingAnswerFacts({
+            ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
+            ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+            ...(req.mandated === true ? { mandated: true } : {}),
+            toolName: req.toolName,
+        }));
+        if (rememberRefused)
+            frame.rememberRefused = true;
+        else
+            delete frame.rememberRefused;
+        if (cardForFrame !== undefined && (cardForFrame.rememberRefused === true) !== rememberRefused) {
+            const { rememberRefused: _stale, ...cardRest } = cardForFrame;
+            cardForFrame = rememberRefused ? { ...cardRest, rememberRefused: true } : cardRest;
+        }
         const pendingEntry = {
             settle,
             forceParkNow,
@@ -2212,11 +2237,7 @@ export class ToolApprovalCoordinator {
     }
     finishRespond(id, entry, parsed, opts) {
         let rememberApplied;
-        const grantable = standingAnswerMayRetire({
-            governanceForced: entry.governanceForced === true,
-            requiresRealApproval: entry.requiresRealApproval === true,
-            mandated: entry.mandated === true,
-        });
+        const grantable = standingAnswerMayRetire(pendingEntryStandingAnswerFacts(entry));
         if (parsed.value === "allow_session")
             rememberApplied = Boolean(entry.sessionId) && grantable;
         if (parsed.value === "allow_session" && entry.sessionId && grantable) {
@@ -2260,6 +2281,7 @@ export class ToolApprovalCoordinator {
                 ...(e.requiresRealApproval ? { requiresRealApproval: true } : {}),
                 ...(e.governanceForced ? { governanceForced: true } : {}),
                 ...(e.mandated ? { mandated: true } : {}),
+                ...(standingAnswerMayRetire(pendingEntryStandingAnswerFacts(e)) ? {} : { rememberRefused: true }),
                 ...(e.mandate !== undefined ? { mandate: e.mandate } : {}),
                 ...(e.origin !== undefined ? { origin: e.origin } : {}),
                 ...(e.originTaskId !== undefined ? { fromSubagent: true, originTaskId: e.originTaskId } : {}),

package/dist/trace/core-keyset-guard.d.ts

@@ -47,7 +47,7 @@ type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTask
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
-type AskFrameServerMinted = "type" | "approvalId" | "argsOmitted" | "outcome" | "governanceForced" | "expiresAtMs" | "expiresInMs" | "serverNowMs" | "parked" | "inputHasBidi";
+type AskFrameServerMinted = "type" | "approvalId" | "argsOmitted" | "outcome" | "governanceForced" | "expiresAtMs" | "expiresInMs" | "serverNowMs" | "parked" | "inputHasBidi" | "rememberRefused";
 type _GuardAskFrame = AssertAllKeysHandled<Exclude<keyof ToolApprovalFrame, AskProjected | AskFrameServerMinted>>;
 type _GuardAskFrameReverse = AssertAllKeysHandled<Exclude<AskProjected | AskFrameServerMinted, keyof ToolApprovalFrame>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta" | "tool_progress" | "tool_disclosure";
@@ -129,7 +129,7 @@ type WiringGovernanceHandled = "audience" | "lockedConfig" | "compliance" | "mem
 type _GuardWiringGovernance = AssertAllKeysHandled<Exclude<keyof WiringSection<"governance">, WiringGovernanceHandled>>;
 type _GuardWiringGovernanceReverse = AssertAllKeysHandled<Exclude<WiringGovernanceHandled, keyof WiringSection<"governance">>>;
 type PermissionTraceKind = Extract<TraceEvent["kind"], `permission.${string}`>;
-export type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed";
+export type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed" | "permission.skill_allowed";
 type PermissionTraceDropped = "permission.sandbox_admitted" | "permission.rule_sync_resurrected" | "permission.rule_sync_dropped" | "permission.org_snapshot_unavailable";
 type _GuardPermissionTrace = AssertAllKeysHandled<Exclude<PermissionTraceKind, PermissionTraceProjected | PermissionTraceDropped>>;
 type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTraceProjected | PermissionTraceDropped, PermissionTraceKind>>;
@@ -144,11 +144,11 @@ type ParkArmKeys = keyof Extract<PendingAction, {
     kind: "tool_approval";
 }>;
 type ParkArmQueueProjected = "toolName" | "toolCallId" | "boundInputHash" | "ruleOffers" | "hasBidiControls" | keyof import("../approval-card.js").ParkRowFacts;
-type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy";
+type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "boundGrantDigest";
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills";
 type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "outputStyle";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;

package/dist/trace/self-minted-wire.d.ts

@@ -113,6 +113,48 @@ export declare const SELF_MINTED_WIRE: {
             };
         };
     };
+    /**
+     * 审批问的**无人决终态归因**:`POST /v1/tasks/:taskId/asks/:askId/decision` 410 `gone.ask` 体的 `deniedReason`(问账行 `denied_reason` 列原值)。
+     * 词表属主 = `approval-deny-reasons.ts` 的 `DENY_REASONS` ∪ `VOID_REASONS`(`satisfies Record<DenyReason | VoidReason, …>`:表加词而本行没跟 ⇒ tsc 红)。
+     * 7.116.0 +2:启动收敛(承载它的进程没了)的两个词 —— 与 `crashConvergedCause` 同词(同一问在两个读面上一个成因)。
+     */
+    readonly askTerminalReason: {
+        readonly at: "POST /v1/tasks/:taskId/asks/:askId/decision 410 gone.ask deniedReason";
+        readonly members: {
+            routing_failure_fail_closed: {
+                attr: string;
+                since: string;
+            };
+            run_cancelled: {
+                attr: string;
+                since: string;
+            };
+            batch_aborted: {
+                attr: string;
+                since: string;
+            };
+            batch_bound_elsewhere: {
+                attr: string;
+                since: string;
+            };
+            adhoc_leg_no_durable_domain: {
+                attr: string;
+                since: string;
+            };
+            orphan_ttl_exceeded: {
+                attr: string;
+                since: string;
+            };
+            crashed_before_park: {
+                attr: string;
+                since: string;
+            };
+            shutdown_before_park: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
     /** 本仓在出口对 core 值做的变换(值变、键不变)。 */
     readonly wireValueRule: {
         readonly at: "出口值变换(<端点>#<键> → 变换)";

package/dist/trace/self-minted-wire.js

@@ -40,6 +40,19 @@ export const SELF_MINTED_WIRE = {
             "internal.memory_control_plane_corrupt": { attr: 500, since: "7.108.0" },
         },
     },
+    askTerminalReason: {
+        at: "POST /v1/tasks/:taskId/asks/:askId/decision 410 gone.ask deniedReason",
+        members: {
+            routing_failure_fail_closed: { attr: "-", since: "7.3.0" },
+            run_cancelled: { attr: "-", since: "7.3.0" },
+            batch_aborted: { attr: "-", since: "7.3.0" },
+            batch_bound_elsewhere: { attr: "-", since: "7.3.0" },
+            adhoc_leg_no_durable_domain: { attr: "-", since: "7.3.0" },
+            orphan_ttl_exceeded: { attr: "-", since: "7.3.0" },
+            crashed_before_park: { attr: "-", since: "7.116.0" },
+            shutdown_before_park: { attr: "-", since: "7.116.0" },
+        },
+    },
     wireValueRule: {
         at: "出口值变换(<端点>#<键> → 变换)",
         members: {

package/dist/user-input-ledger.d.ts

@@ -13,15 +13,18 @@
  * 「本服务以回执向调用方承诺已交给引擎、而消费只发生在进程内存里的用户输入」,**且承载它的那只 `TaskStream` 活在本服务的一条 run 腿里**(S-966)——
  * 后半句是收敛判词成立的前提:证据面是那条 run 行(下文「收敛判据」)。行的 `taskId` = 回执上的 run、`sessionId` = 那条 run 的会话(人看的那一只),
  * run 里是哪一只流(run 自己的 / 同步子代的)**不是**账本的事实:告知按 run 并帧(`steer` = 条数),读面行同形。今天只有 steer 一族(`kind:"steer"` =
- * core 的车道词:引擎把这些输入记在 steer 车道),三个入口同一个引擎动词 `TaskStream.steer`:
+ * 受理它的引擎动词 `TaskStream.steer`,三档 `now` / `next` / `later` 同一个动词同一族),三个入口同一个引擎动词:
  *  · `POST /v1/runs/:id/steer` 的 live 腿(200 applied);
  *  · `POST /v1/runs/:id/interrupt` 的带 text 形(202 queued-immediate,档位 now;设计稿把它划在病面外,车 SW 亲核它进的是同一只进程内队列 ⇒ 同类同修);
  *  · `POST /v1/runs/:id/subagents/:target/steer`(200 applied,S-966)—— 投进**同步子代**自己的流(core `createSteerHandle` → `stream.steer`)。子代由父腿
  *    await,父腿收场时 core 撤掉在飞的复活(`subagentRetain.disposeAll`),所以它活在父 run 的腿里;腿 = 子代句柄,`handle.settled` 兑现 ⇒ 结清。
  * 规则的反面(不是例外表):workflow agent steer(`POST /v1/workflows/:id/agents/:label/steer`,200 applied)不在本账 —— workflow 是会话锚定的后台件
  * (core `WorkflowTaskHandle.sessionScoped`),活得比发起它的 run 腿长,没有一条 run 行约束它,而 workflow run 行上没有持有者列 ⇒ 判不出写者死没死(另票);
- * 子代 resume(`…/subagents/:target/resume`)不往在飞的队列里投,起的是一条新的子代腿;follow-up 在本仓**没有**进程内受理口(`src/http/routes` 零
- * follow-up 入口;steer 路由不下传 `priority`,core 缺省 `next` = steer 车道)⇒ 闭集一词,不预留第二词。
+ * 子代 resume(`…/subagents/:target/resume`)不往在飞的队列里投,起的是一条新的子代腿;follow-up 在本仓**没有**独立的受理口(`src/http/routes` 零
+ * follow-up 入口)。steer 的 `later` 档在引擎里走 follow-up 车道(引擎在腿收场时按车道分账:没投出去的 `later` 记进 `task.user_followup_undrained`),
+ * 但它仍是一次 `TaskStream.steer` 受理、消费帧同为 `human_input{delivery:"applied"}`(两车道同一只消费口)⇒ 同进本账,消费即结清;崩溃告知走 core 唯一的
+ * 服务层臂 `task.user_steer_undrained{cause:"crashed"}`(core 对该臂的定义按动词:服务层受理过的 steer)。follow-up 一族在 core 里没有 `cause` 键、没有
+ * 服务层臂 ⇒ 本账无处按车道归档,要按车道归档须 core 先给那一臂(上游待答)⇒ 闭集一词,不预留第二词。
  *
  * ## 五形行(append-only;行序 = 语义序;File 孪生的盘上形 = 下面的 {@link UserInputLedgerRecord},SQL 孪生 = 一行一受理 + CAS 列 + 删行,同义)
  *  · `accepted`  —— 受理点(`routes/runs.ts` 的 live 腿,**调 `TaskStream.steer` 之前**、回 200 之前)写;写不进 ⇒ 503
@@ -50,8 +53,8 @@
  * ## 收敛判据(一条:**受理它的进程已经不在,而承载它的腿没有正常收场**)—— 两车道同一只判词({@link judgeOpen},S-969 L8 合一)
  * 证据面只有一个:承载它的 **run 行**(run 店;行上的 `instanceId` = 当前持有者,createRun 铸、markResuming 接管)。
  *  · 行在、持有者是写者、仍 `running` ⇒ 腿没收场;写者在不在由车道答(下一段)—— 不在 ⇒ `crashed`,可能在 ⇒ `live`(不动,等 reaper)。
- *  · 行在、持有者是写者、`failed` 且落款是 run 店的**死亡判决**({@link isHolderDeathVerdict}:`reapStale` 的 `RUN_STALLED_ERROR` /
- *    File 车道孤儿回收与 claim 接管的 `RUN_ORPHANED_ERROR`)⇒ 写者死在腿收场之前 ⇒ `crashed`。判决落盘之后才收(codex r1-F1 / r3-F1:
+ *  · 行在、持有者是写者、`failed` 且行上是 run 店的**死亡判决码**({@link isHolderDeathVerdict}:`reapStale` 的 `run.stalled` /
+ *    File 车道孤儿回收与 claim 接管的 `run.orphaned`;7.116.0 起按码判,句子只给人读)⇒ 写者死在腿收场之前 ⇒ `crashed`。判决落盘之后才收(codex r1-F1 / r3-F1:
  *    读到的旧心跳不算 —— 读后写者可能恢复;收敛与 reap 的先后因此不承重)。维护 tick 里收敛排在 reapStale **之后**(同一条腿串行)。
  *  · 其余 —— 行正常翻面(完成 / 失败 / 取消)、已 park(suspended / needs_review:引擎把未消费的 steer 迁进检查点,续跑重投)、易手(续跑被别的
  *    进程接走)⇒ 腿正常收场了,只是没人替它落 settle ⇒ 补落 `settled{leg_end}`(判词 `leg_over`,见 {@link OpenVerdict}),不告知。