@sema-agent/server 7.115.0 → 7.116.1

package/dist/approval-crash-convergence.js

@@ -0,0 +1,75 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { APPROVAL_ASK_AUDIT_DIR, APPROVAL_ASK_AUDIT_LEDGER, FileApprovalAskAuditStore } from "./approval-ask-audit-store.js";
+import { ApprovalCardEnvelopeSchema } from "./approval-card.js";
+import { VOID_REASONS } from "./approval-deny-reasons.js";
+import { writerGoneEvidenceFor } from "./user-input-ledger.js";
+import { recordFailOpen } from "./observability/fail-open.js";
+const CONVERGE_PAGE = 500;
+export function totalAsksVoided(report) {
+    return Object.values(report.asksVoided).reduce((sum, n) => sum + n, 0);
+}
+export function openAuditEvidenceForConvergence(live, localDataRoot) {
+    if (live !== undefined)
+        return { audit: live, release: () => { } };
+    if (localDataRoot === undefined || !existsSync(join(localDataRoot, APPROVAL_ASK_AUDIT_DIR, APPROVAL_ASK_AUDIT_LEDGER)))
+        return { audit: undefined, release: () => { } };
+    const opened = new FileApprovalAskAuditStore(localDataRoot);
+    return { audit: opened, release: () => opened.close() };
+}
+export async function convergeCrashedAsksAtBoot(input) {
+    const now = input.now ?? Date.now;
+    const audited = input.audit?.convergeCrashedAsks() ?? { pending: 0, decided: 0, inconsistent: 0, corruptLines: 0 };
+    const asksVoided = { [VOID_REASONS.HOLDER_CRASHED]: 0, [VOID_REASONS.HOLDER_SHUTDOWN]: 0 };
+    let causeUnreadable = 0;
+    const store = input.askStore;
+    if (store !== undefined) {
+        const seen = new Set();
+        for (;;) {
+            const page = (await store.listByState("STREAM_PENDING", CONVERGE_PAGE)).filter((r) => !seen.has(r.askId));
+            if (page.length === 0)
+                break;
+            for (const row of page) {
+                seen.add(row.askId);
+                const envelope = ApprovalCardEnvelopeSchema.safeParse(row.cardJson);
+                if (!envelope.success) {
+                    causeUnreadable += 1;
+                    recordFailOpen("server.approval-crash-convergence.cause-unreadable", `ask ${row.askId} (task ${row.taskId}): card envelope unreadable — cause defaulted to ${VOID_REASONS.HOLDER_CRASHED}`);
+                }
+                const reason = envelope.success && input.audit !== undefined ? input.audit.causeFor(envelope.data.approvalId) : VOID_REASONS.HOLDER_CRASHED;
+                let won;
+                try {
+                    won = await store.transitionAsk(row.askId, "STREAM_PENDING", "VOID", { deniedReason: reason, updatedAtMs: now() });
+                }
+                catch (err) {
+                    throw new Error(`approval crash convergence: could not close the previous process's pending approval ask ${row.askId} (task ${row.taskId}): ` +
+                        `${err instanceof Error ? err.message : String(err)} — refusing to start, because serving now would leave a card that nothing waits for ` +
+                        "decidable with a 200. Fix the data root (disk full / read-only?) and start again.");
+                }
+                if (won)
+                    asksVoided[reason] += 1;
+            }
+        }
+    }
+    return { ...audited, asksVoided, causeUnreadable };
+}
+export async function runBootCrashConvergence(ctx) {
+    const { backend, runStore, logger } = ctx;
+    if (backend === undefined || runStore === undefined || writerGoneEvidenceFor(backend.kind, runStore).kind !== "exclusive_data_root")
+        return undefined;
+    const evidence = openAuditEvidenceForConvergence(ctx.liveAudit, ctx.localDataRoot);
+    const converged = await convergeCrashedAsksAtBoot({ askStore: backend.approvalAsk(), audit: evidence.audit }).finally(evidence.release);
+    if (converged.pending > 0 || converged.decided > 0 || converged.inconsistent > 0 || converged.corruptLines > 0 || totalAsksVoided(converged) > 0) {
+        logger.warn("approval_ask_audit_crash_converged", {
+            pending: converged.pending,
+            decided: converged.decided,
+            inconsistent: converged.inconsistent,
+            corruptLines: converged.corruptLines,
+            asksVoided: converged.asksVoided,
+            causeUnreadable: converged.causeUnreadable,
+            note: "approval asks left pending by the previous process were converged: each such ask is now VOID in the ask ledger (the decision endpoint answers 410 gone.ask with this cause as deniedReason) and is listed under GET /v1/approvals crashConverged when the audit ledger saw it (cause crashed_before_park = the process crashed; cause shutdown_before_park = an orderly shutdown cut the leg off before it closed or before its park committed)",
+        });
+    }
+    return converged;
+}
+//# sourceMappingURL=approval-crash-convergence.js.map

package/dist/approval-deny-reasons.d.ts

@@ -16,6 +16,8 @@
  * 值域不相交这条纪律的用处(`ALL_TERMINAL_REASONS` 的机器判据钉住不相交性)。
  *
  * 写点纪律(grep 钉):全仓 `DENIED` 只有**一个**写点 = 收敛器判据 2 的非取消臂(`approval-reconciler.ts`)。
+ * 启动收敛(进程没了)落的是 VOID 不是 DENIED:状态机上 `STREAM_PENDING` 没有到 DENIED 的边(DENIED 只在「已路由去 park」之后),
+ * 而承载它的进程没了 = 这条腿死了 = abort 语义。
  */
 /** `DENIED` 终态的归因闭集(v1 单员)。 */
 export declare const DENY_REASONS: {
@@ -49,8 +51,19 @@ export declare const VOID_REASONS: {
     /** 判据 5:任何在 `STREAM_APPROVAL_ORPHAN_TTL_MS` 内仍未收敛的 `PARKING` 行(量 immutable 的
      *  `createdAtMs`,§9 C5)—— 约束①(遗孤最终可判)的最后兜底,带一条 warn。 */
     readonly ORPHAN_TTL_EXCEEDED: "orphan_ttl_exceeded";
+    /**
+     * 启动收敛(`approval-crash-convergence.ts`,local 车道):**承载这一问的进程没了** —— 前世进程崩溃 / 被杀,留下的
+     * `STREAM_PENDING` 行在下一次启动、任何卡能开始之前收成 VOID。证据是数据根 `LOCK`(前世写者全死),不是「等够久了」。
+     * 🔴 值与 `GET /v1/approvals` `crashConverged[].cause` 是**同一个词**(审计店的 `CrashConvergedCause` 从本表取型):
+     * 同一问在两个读面上只有一个成因词。
+     */
+    readonly HOLDER_CRASHED: "crashed_before_park";
+    /** 同上,但承载它的腿是被**有序关停**截断的(审计账本上有本腿的关停记号;关停收尾没能在宽限窗内把这张卡结清)。 */
+    readonly HOLDER_SHUTDOWN: "shutdown_before_park";
 };
 export type VoidReason = (typeof VOID_REASONS)[keyof typeof VOID_REASONS];
+/** 「承载这一问的进程没了」的两个成因词(启动收敛写进问账行 `deniedReason`,审计收敛行 `cause` 读同一型)。 */
+export type HolderGoneReason = typeof VOID_REASONS.HOLDER_CRASHED | typeof VOID_REASONS.HOLDER_SHUTDOWN;
 /** 两组的并集(机器判据用:值域不相交 + 列宽 ≤ 64 的钉子在 test/approval-reconciler.test.ts)。 */
 export declare const ALL_TERMINAL_REASONS: readonly string[];
 //# sourceMappingURL=approval-deny-reasons.d.ts.map

package/dist/approval-deny-reasons.js

@@ -7,6 +7,8 @@ export const VOID_REASONS = {
     BATCH_BOUND_ELSEWHERE: "batch_bound_elsewhere",
     ADHOC_LEG_NO_DURABLE_DOMAIN: "adhoc_leg_no_durable_domain",
     ORPHAN_TTL_EXCEEDED: "orphan_ttl_exceeded",
+    HOLDER_CRASHED: "crashed_before_park",
+    HOLDER_SHUTDOWN: "shutdown_before_park",
 };
 export const ALL_TERMINAL_REASONS = [...Object.values(DENY_REASONS), ...Object.values(VOID_REASONS)];
 //# sourceMappingURL=approval-deny-reasons.js.map

package/dist/approval.js

@@ -4,6 +4,7 @@ import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 import { isExplicitPosture } from "./posture-source.js";
 import { handsOnWorkerFilePlane } from "./execution-lane-caps.js";
 import { heldRuleName } from "./tool-rule-names.js";
+import { answerGrantsBeyondCall } from "./standing-answer-grant.js";
 export function hasApprovalListIntent(config) {
     return (config.approvalRequire.length > 0 ||
         config.approvalDeny.length > 0 ||
@@ -97,7 +98,7 @@ export function createDurableAskPolicy(opts) {
                 if (remEarly !== undefined && remEarly <= 0) {
                     return operatorAlwaysHumanAsk("RESOURCE_SUSPEND budget exhausted", `durable resource budget exhausted — human approval required to run "${req.toolName}"`);
                 }
-                if (opts.exempt && heldRuleName(req, isQuestionTool) === undefined) {
+                if (opts.exempt && heldRuleName(req, isQuestionTool) === undefined && !answerGrantsBeyondCall(req)) {
                     return (async () => {
                         let exempted = false;
                         try {

package/dist/boot/coordinators.js

@@ -43,18 +43,6 @@ export function createLiveCoordinators(ctx) {
     const approvalAskAudit = config.toolApprovalEnabled && backend?.kind === "local" && config.localDataRoot !== undefined
         ? new FileApprovalAskAuditStore(config.localDataRoot)
         : undefined;
-    if (approvalAskAudit) {
-        const converged = approvalAskAudit.convergeCrashedAsks();
-        if (converged.pending > 0 || converged.decided > 0 || converged.inconsistent > 0 || converged.corruptLines > 0) {
-            logger.warn("approval_ask_audit_crash_converged", {
-                pending: converged.pending,
-                decided: converged.decided,
-                inconsistent: converged.inconsistent,
-                corruptLines: converged.corruptLines,
-                note: "orphan approval asks from the previous process were converged (cause crashed_before_park = it crashed; cause shutdown_before_park = an orderly shutdown cut the leg off before it closed or before its park committed); see GET /v1/approvals crashConverged",
-            });
-        }
-    }
     const approvalExemptionStore = backend ? backend.approvalExemption() : undefined;
     const toolApproval = config.toolApprovalEnabled
         ? new ToolApprovalCoordinator({

package/dist/boot/execution-env.js

@@ -15,6 +15,7 @@ import { localDockerExecutionEnvFactory } from "../plugins/remote-env-local-dock
 import { sshExecutionEnvFactory } from "../plugins/remote-env-ssh.js";
 import { isRemoteScratchpadLane, withRemoteScratchpad } from "../plugins/remote-scratchpad.js";
 import { FileSchedulerBackend, defaultSchedulerStorePath } from "../plugins/scheduler-support.js";
+import * as facts from "../capability-facts.js";
 import { materializeAttachmentsInto } from "../plugins/task-attachment-store.js";
 import { reapOrphanWorktrees, withWorktreeIsolation } from "../plugins/worktree-isolation.js";
 import { customPkgSourceFromEnv, derivePkgSourceEnv } from "../sandbox-pkg-source.js";
@@ -204,7 +205,7 @@ export function createExecutionEnv(ctx) {
     }
     else if (config.remoteExec?.provider === "host") {
         {
-            const hostScheduler = config.schedulerEnabled && config.requirePrincipal !== true
+            const hostScheduler = facts.hostScheduler(config).available
                 ? new FileSchedulerBackend({
                     ...(config.schedulerStorePath ? { storePath: config.schedulerStorePath } : {}),
                     ...(config.schedulerSessionWakeup === false || config.schedulerSessionLifetime === false

package/dist/boot/resolve-spec.js

@@ -442,6 +442,7 @@ export function createResolveSpec(ctx) {
                 return merged && config.toolDeferLongtail ? applyLongtailDefer(merged, true) : merged;
             })(cap.tools),
             skills: body.disableSkills === true ? [] : mergeUserSkills(cap.skills, body.skills, logger),
+            ...(() => { const v = toolNameListFromBody(body.userInvokedSkills); return v ? { userInvokedSkills: v } : {}; })(),
             ...(parsedSettings.settings?.skillListingBudgetFraction !== undefined ? { skillListingBudgetFraction: parsedSettings.settings.skillListingBudgetFraction } : {}),
             ...(parsedSettings.settings?.skillListingMaxDescChars !== undefined ? { skillListingMaxDescChars: parsedSettings.settings.skillListingMaxDescChars } : {}),
             mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, logger, opts?.onNotice !== undefined ? { sessionId: auth?.sessionId, emit: opts.onNotice } : undefined),

package/dist/boot/stage-07-capability-layer.js

@@ -16,6 +16,7 @@ import { explicitOperatorOk } from "../http/server.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
 import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
 import { reclaimOrphansAtBoot } from "../boot-reclaim.js";
+import { runBootCrashConvergence } from "../approval-crash-convergence.js";
 import { createUserInputLedgerAtBoot, writerGoneEvidenceFor } from "../user-input-ledger.js";
 import { createParkedReviveInheritedGate } from "./parked-revive-gate.js";
 import { createParkedReviveSurface } from "../parked-revive-surface.js";
@@ -23,8 +24,9 @@ import { createWebFetchSummarizeLane } from "./webfetch-summarize-lane.js";
 import { createRunnerDepsOnAsk } from "./runner-deps.js";
 import { bindRateLimiter, bindRunStore } from "./late-binds.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
+import * as facts from "../capability-facts.js";
 export async function runStage07(ctx) {
-    const { approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, config, configCenter, counterDegradeHook, durableEnabled, handslessSubRunner, instanceId, localRoot, logger, memoryEngine, metrics, question, runner, runnerDeps, sendUserFileToolSpec, sessionEnvSelection, sessionStore, subRunner, subRunnerSessions, taskListLane, toolApproval } = ctx;
+    const { approvalAskAudit, approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, config, configCenter, counterDegradeHook, durableEnabled, handslessSubRunner, instanceId, localRoot, logger, memoryEngine, metrics, question, runner, runnerDeps, sendUserFileToolSpec, sessionEnvSelection, sessionStore, subRunner, subRunnerSessions, taskListLane, toolApproval } = ctx;
     const authorize = createAuthorizer(config, sessionStore);
     const runStore = backend ? backend.run() : undefined;
     bindRunStore(runStore);
@@ -51,6 +53,7 @@ export async function runStage07(ctx) {
     if (gateRefusal !== undefined)
         throw new Error(gateRefusal);
     await reclaimOrphansAtBoot(runStore, checkpointStore, logger);
+    await runBootCrashConvergence({ backend, runStore, liveAudit: approvalAskAudit, localDataRoot: config.localDataRoot, logger });
     const userInputLedgerStore = backend && runStore ? backend.userInputLedger() : undefined;
     const userInputLedger = backend && runStore && userInputLedgerStore
         ? await (async () => {
@@ -79,14 +82,22 @@ export async function runStage07(ctx) {
     if (durableEnabled)
         logger.info("durable_approval_enabled", { toolApprovalGate: config.approvalRequire.length });
     if (config.a2aServe) {
-        logger.info("a2a_serve_enabled", {
-            card: "/.well-known/agent-card.json",
-            rpc: "/v1/a2a",
-            advertisedUrl: buildDisplaySafeUrl(config.a2aServe.url),
-            skills: config.a2aServe.skills.length,
-            blockingWaitMs: config.a2aServe.blockingWaitMs,
-            tasksUsable: runStore !== undefined,
-        });
+        const peer = facts.a2aServe({ config, runStore });
+        if (peer.available) {
+            logger.info("a2a_serve_enabled", {
+                card: "/.well-known/agent-card.json",
+                rpc: "/v1/a2a",
+                advertisedUrl: buildDisplaySafeUrl(config.a2aServe.url),
+                skills: config.a2aServe.skills.length,
+                blockingWaitMs: config.a2aServe.blockingWaitMs,
+            });
+        }
+        else {
+            logger.warn("a2a_serve_not_served", {
+                reason: peer.why,
+                detail: "A2A_SERVE_ENABLED is on but this worker has no durable run store, so the agent card and POST /v1/a2a answer 404 (message/send and tasks/get both need it) — set DB_BACKEND=mysql|pg|local, or turn A2A_SERVE_ENABLED off",
+            });
+        }
     }
     for (const w of buildNoResponderBootWarns({
         lane: executionLaneOf(config.remoteExec?.provider),
@@ -148,12 +159,7 @@ export async function runStage07(ctx) {
         ensureChildSessionDurable: ensureChildSessionDurable ? ensureChildSessionDurable : undefined,
         taskListStoreFor: taskListLane.storeFor,
         brandIdentity: config.configProvider === "local",
-        subagentExtraTools: sendUserFileToolSpec
-            ? subagentSendUserFileExtraTools({
-                spec: sendUserFileToolSpec,
-                approvalGate: () => ({ deny: config.approvalDeny, require: config.approvalRequire, neverAuto: config.approvalNeverAuto }),
-            })
-            : undefined,
+        subagentExtraTools: sendUserFileToolSpec ? subagentSendUserFileExtraTools({ spec: sendUserFileToolSpec }) : undefined,
     };
     const scenarios = buildScenarios(scenarioDeps);
     const builtinDefaultScenario = scenarios.default;

package/dist/boot/stores.js

@@ -1,5 +1,5 @@
 import { join } from "node:path";
-import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore, FileUsageWindowStore, InMemoryUsageWindowStore, mailboxCrossProcessMountVerdict } from "@sema-agent/core";
+import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore, InMemoryUsageWindowStore, mailboxCrossProcessMountVerdict } from "@sema-agent/core";
 import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "../memory-sync-client.js";
 import { memoryEmbedderFor } from "../plugins/memory-embedder.js";
@@ -333,13 +333,13 @@ export async function openStores(ctx) {
             await ensureTiDBUsageWindowSchema(mysqlPool);
             usageWindowStore = new TiDBUsageWindowStore(mysqlPool);
         }
-        else if (backend?.kind === "local") {
-            usageWindowStore = new FileUsageWindowStore(config.localDataRoot ?? localRoot);
+        else if (backend?.fileUsageWindowStore !== undefined) {
+            usageWindowStore = backend.fileUsageWindowStore();
         }
         else {
             usageWindowStore = new InMemoryUsageWindowStore();
         }
-        logger.info("usage_window_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "tidb" : backend?.kind === "local" ? "file" : "memory", windows: config.usageWindows.length });
+        logger.info("usage_window_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "tidb" : backend?.fileUsageWindowStore !== undefined ? "file" : "memory", windows: config.usageWindows.length });
     }
     const memoryExportBackend = config.memoryEngineBackend !== "file" ? memoryEngine?.backend : undefined;
     const memoryLane = memoryEngineRemoteLanePosture(config);

package/dist/capabilities/hands-lane.d.ts

@@ -33,29 +33,6 @@ export interface HandsRunnerPair {
 }
 /** 按场景表态取 Runner。**穷举 switch**:`ScenarioHands` 加词而此处不改 = 编译错(无 default 臂)。 */
 export declare function pickHandsRunner(hands: ScenarioHands, pair: HandsRunnerPair): Runner;
-/**
- * core 手带 band 的工具名**全集** —— 「挂 executionEnvFactory 才出现、不挂就消失」的那一批。
- *
- * 两段来源,都不是拍脑袋:
- *  · `handBandEffects()`(core 7.8.0 B1 起的导出面;此前是手抄表常量 `HAND_TOOL_EFFECTS`)—— band 的
- *    effect 表,由**静态工具目录**按 `mountedBy.includes("hands")` 派生。名册单源之后这张表不再是一张
- *    手抄名表,加/退工具由目录一处说了算。
- *  · 下方锚定补集 —— `createHandsToolkit` / 手带块还会铸但**不在** effect 表里的 5 名(实测差集,见
- *    test/scenario-hands-lane.test.ts 的对表格:它用真 Runner 跑「有手 roster ∖ 无手 roster」,与本常量逐名对账,
- *    core 加/改 band 成员时红,防漂移)。
- *
- * ⚠️ 本全集是**观测口径**(用于防漂移对账),**不是** deny 名单 —— deny 用下面的
- * {@link HANDS_EXCLUSIVE_TOOL_NAMES},理由见那里。
- *
- * 🚨 [ref] P0(2026-08-09):派生时必须过滤 core 的 `RETIRED_TOOL_NAMES` —— core 5.21.0 的
- * `HAND_TOOL_EFFECTS` 里残留已退役的 `MultiEdit`,而 core `prepare-task` 的策略名审计见退役名
- * **无条件 throw**(`config.legacy_tool_name`);不过滤,deny 名单一进 `spec.toolPolicy`,
- * `hands: none` 三场景(scan/code-review/team)在**所有部署**上零 turn 全灭。core 5.21.1 已删
- * 那条死条目([ref]),这道 filter 是结构性防御:将来 core 再退役任何 band 名都不会重演
- * (test/scenario-hands-lane.test.ts 格7/格8 双钉:真 Runner 过审计 + 零交集门)。
- * filter 打在**整表**(effect 表 + 锚定补集)之后 —— caret floor 下装置会解析到更新的 core,
- * 补集名哪天被退役,只滤前半就是同一次故障换个名字(codex 复审 finding,2026-08-09)。
- */
 export declare const HANDS_BAND_TOOL_NAMES: readonly string[];
 /**
  * band 里**只有手才可能出现**的那批(= deny 名单)。

package/dist/capabilities/hands-lane.js

@@ -1,4 +1,4 @@
-import { handBandEffects, RETIRED_TOOL_NAMES, combinePolicies, createAllowDenyPolicy } from "@sema-agent/core";
+import { handBandEffects, judgeRuleToolName, combinePolicies, createAllowDenyPolicy } from "@sema-agent/core";
 export function withoutExecutionEnv(deps) {
     const { executionEnvFactory: _handsDropped, ...rest } = deps;
     return rest;
@@ -11,6 +11,7 @@ export function pickHandsRunner(hands, pair) {
             return pair.handsless;
     }
 }
+const NO_DECLARED_TOOL_NAMES = new Set();
 export const HANDS_BAND_TOOL_NAMES = Object.freeze([
     ...handBandEffects().keys(),
     "SendMessage",
@@ -19,7 +20,7 @@ export const HANDS_BAND_TOOL_NAMES = Object.freeze([
     "EnterWorktree",
     "ExitWorktree",
     "ListAgents",
-].filter((n, i, all) => !RETIRED_TOOL_NAMES.has(n) && all.indexOf(n) === i));
+].filter((n, i, all) => judgeRuleToolName(n, NO_DECLARED_TOOL_NAMES).kind === "current" && all.indexOf(n) === i));
 export const HANDS_DUAL_USE_TOOL_NAMES = Object.freeze(["TaskOutput", "TaskStop", "SendMessage", "AgentTranscript", "ListAgents"]);
 export const HANDS_EXCLUSIVE_TOOL_NAMES = Object.freeze(HANDS_BAND_TOOL_NAMES.filter((n) => !HANDS_DUAL_USE_TOOL_NAMES.includes(n)));
 export function handsDenyPolicy() {

package/dist/capabilities/send-user-file-tool.d.ts

@@ -44,32 +44,20 @@ export declare function sendUserFileTool(deps: {
 }): ToolSpec;
 export declare const SEND_USER_FILE_TOOL_NAME = "SendUserFile";
 /**
- * Build the `SubagentToolOptions.extraTools` factory that injects SendUserFile into delegated-child rosters —
- * WITH the two gates the bare `() => [spec]` wiring lacked:
+ * Build the `SubagentToolOptions.extraTools` factory that injects SendUserFile into delegated-child rosters.
  *
- * F1 (HIGH, codex): the subRunner carries NO tool policy and core's child spec does not inherit the parent's
- * `toolPolicy`, so an extraTools-injected SendUserFile BYPASSED the deployment approval gate (evidence: with
- * `APPROVAL_DENY=SendUserFile` the top-level call is denied but a delegated child could still call it). Until
- * core lands a child-policy propagation seam, the CONSERVATIVE server-side stopgap is a deployment-policy
- * PRE-CHECK: if the deployment's approval face gates SendUserFile at all (deny OR ask — approvalDeny /
- * approvalRequire / approvalNeverAuto, matched in canonical space exactly like src/approval.ts), the factory
- * injects NOTHING. deny obviously must not reach children; ask-gated is ALSO withheld because the child leg has
- * no policy to route the ask (injecting would silently auto-allow — the exact bypass). The gate is read LIVE per
- * spawn (a getter, not a boot snapshot) so center/env hot-applied governance is honored, mirroring how the
- * per-request approval baseline reads live config. A deployment with no gate intent is unchanged.
+ * F2 (MED, codex; a product judgment of this server, kept): read-only builtin agents (Explore/Plan) must NOT get
+ * SendUserFile — a read-only agent that can read sensitive files AND mint public links off them breaks the read-only
+ * posture (their denyTools sets predate this tool, so core's resolveToolSubset would let it through). `ctx.agentType`
+ * carries the spawned definition's name (core subagent.js); membership in core's builtin catalog ⇒ inject nothing.
  *
- * F2 (MED, codex): read-only builtin agents (Explore/Plan) must NOT get SendUserFile — a read-only agent that
- * can read sensitive files AND mint public links off them breaks the read-only posture (their denyTools sets
- * predate this tool, so core's resolveToolSubset would let it through). `ctx.agentType` carries the spawned
- * definition's name (core subagent.js); membership in core's builtin catalog ⇒ inject nothing for that spawn.
+ * 🔴 S-1058(7.116.0):修前这里还有一道 **F1 部署策略预判** —— 部署审批面(`APPROVAL_DENY` / `REQUIRE` / `NEVER_AUTO`)点名 SendUserFile 就一只都
+ * 不注入,前提是「subRunner 不带策略、core 的子代不继承父的 toolPolicy」(core 1.287 时的事实)。core 自 7.40.1 起顶层 run 解析后的调用方策略
+ * (`spec.toolPolicy ?? deps.toolPolicy`)与它冻结的审批席经继承链(`InheritedGate.parentConstraints`)判子代的注入工具:deny ⇒ 零执行;ask ⇒ 顶层
+ * 审批席被问一次;无审批席 ⇒ 拒(core 7.41.0 钉)。本仓在真实装配上亲跑十格(spec / deps 两槽 × deny / ask 允 / ask 拒 / 无审批席 / 耐久车道无活席,
+ * `test/subagent-extra-tools-ancestor-policy-s1058.test.ts`)全部成立 ⇒ 预判整段删:部署的判决在继承链上由策略本身做,本仓不再复刻一份「按名单猜」。
  */
 export declare function subagentSendUserFileExtraTools(deps: {
     spec: ToolSpec;
-    /** LIVE deployment approval face (config.approvalDeny/approvalRequire/approvalNeverAuto) — evaluated per spawn. */
-    approvalGate: () => {
-        deny?: string[];
-        require?: string[];
-        neverAuto?: string[];
-    };
 }): (ctx: SubagentSpawnContext) => ToolSpec[];
 //# sourceMappingURL=send-user-file-tool.d.ts.map

package/dist/capabilities/send-user-file-tool.js

@@ -94,13 +94,6 @@ export function sendUserFileTool(deps) {
 export const SEND_USER_FILE_TOOL_NAME = "SendUserFile";
 const READONLY_BUILTIN_AGENT_TYPES = new Set(builtinAgentDefinitions().map((d) => d.name));
 export function subagentSendUserFileExtraTools(deps) {
-    const canonical = SEND_USER_FILE_TOOL_NAME;
-    return (ctx) => {
-        if (ctx.agentType !== undefined && READONLY_BUILTIN_AGENT_TYPES.has(ctx.agentType))
-            return [];
-        const gate = deps.approvalGate();
-        const gated = [...(gate.deny ?? []), ...(gate.require ?? []), ...(gate.neverAuto ?? [])].some((t) => t === canonical);
-        return gated ? [] : [deps.spec];
-    };
+    return (ctx) => (ctx.agentType !== undefined && READONLY_BUILTIN_AGENT_TYPES.has(ctx.agentType) ? [] : [deps.spec]);
 }
 //# sourceMappingURL=send-user-file-tool.js.map