@sema-agent/server 7.117.0 → 7.118.0

package/dist/host-decision.d.ts

@@ -1,6 +1,7 @@
 /**
  * **宿主的决策事实** —— 一条耐久 park 被结算时,本服务能如实陈述的那半件事:谁结束了这次等待,以及
- * 审批通道自报的归属。一个叶子模块(只依赖 `@sema-agent/core`),四个消费点共用一个定义。
+ * 审批通道自报的归属,以及决定体上陈述「谁决定的」那一只键(`decidedBy`)的闭集、读法与映射。一个叶子模块
+ * (运行期只依赖 `@sema-agent/core`;另一处 import 是纯类型的编译期门),全部决定口共用一个定义。
  *
  * ## 为什么是「事实」而不是「结算词」(core 7.6.0 / [ref] S6-A,BREAKING)
  *
@@ -17,14 +18,12 @@
 import { type AskOutcome, type ResumeOutcome } from "@sema-agent/core";
 /**
  * 谁结束了这次等待,以及通道自报的归属。
- *  · `decidedBy: "person"` —— 运维经审批通道做的决定(两条 HTTP `/decide` 腿);
+ *  · `decidedBy: "person"` —— 一个人经审批通道做的决定(决定体缺席 `decidedBy` 即此);
  *  · `decidedBy: "sla_timeout"` —— 宿主自己的 SLA 扫在行的 deadline 上判的(FACET A;**只有** sweep 能这么说,
- *    而 sweep 结构上不能 `allow`)。
- *  · `decidedBy: "policy"`(core 7.26.2 / #1016)—— **这台部署自己的策略**拒的:答话的是机器不是人。调用方
- *    经决裁体的 `settledBy` 自报;core 据它给模型铸一句**策略句**(而不是「用户不同意,停下来等他」),
- *    并把结算记成 `policy_refused`(`who.party:"policy"`,core 7.39.0 #1265 起;此前 `"none"`)。`allow` 侧:core 7.39.0 起引擎收策略的
- *    放行(`policy_allowed`),但本仓的两条 decide 口**不开**这一形(`tool-approval.ts` 的 `SETTLED_BY_ONLY_ON_DENY` 与店列的同一条拒仍在 ——
- *    耐久车道上的机器放行是一件没裁过的新能力,不在 7.113.0 提货批内,候登)。
+ *    而 sweep 结构上不能 `allow`;wire 上永不受理,见 {@link APPROVAL_DECIDED_BY})。
+ *  · `decidedBy: "policy"` —— **这台部署自己的策略**答的:答话的是机器不是人,`allow` 与 `deny` 两向都可以。
+ *    调用方经决定体的 `decidedBy` 陈述;core 据它铸 `policy_allowed` / `policy_refused`(`who.party:"policy"`),
+ *    拒的那一向给模型一句**策略句**(而不是「用户不同意,停下来等他」)。
  *  · `approver` —— 通道自报的结算方标识串。**缺席永不读成**「没人批」或「有人批」,只意味着通道没报名字。
  */
 /**
@@ -33,9 +32,9 @@ import { type AskOutcome, type ResumeOutcome } from "@sema-agent/core";
  *  · **铸**(本仓自己观察到的事实):只有 `"timeout"` —— 同步 `onAsk` 腿的等待窗归**宿主**所有(引擎不为
  *    一个它没排程的回调起表),所以「本仓的 TTL 窗走完了、没人答」这件事引擎结构上观察不到,不自报就
  *    永远被记成「一个人拒绝了」;
- *  · **转**(调用方在回决体里自报的事实,core 7.26.2 / #1016 起):`settledBy:"policy"` = 答这张卡的是
- *    **这台部署自己的策略**,不是人。本仓**零判据、原样过境**:词的拒绝逻辑归引擎(`resolveAsk` 对
- *    自报词表外的值是响亮 fail-closed deny),本仓抄一份词表的那天 core 加词就会被静默 400 掉。
+ *  · **转**(调用方在决定体里陈述的事实):决定体的 `decidedBy:"policy"` 经 {@link liveSettledBy} 落成这一格的
+ *    `"policy"` = 答这张卡的是**这台部署自己的策略**,不是人。wire 上的词只有 {@link APPROVAL_DECIDED_BY} 两个,
+ *    映射只有那一只函数 —— 这一格的「转」不再是一个原样过境的串。
  * 逐词(词表属主恒是 core):
  *  · `"human"` —— 与「不铸这个键」逐字同义(core 缺席即按人处理);
  *  · `"aborted"` —— core **明令拒收**宿主自报(那是引擎自家 fail-closed 端的词,宿主自报等于把自己的
@@ -62,13 +61,78 @@ export type HostDecision = Extract<ResumeOutcome, {
  *  编译期先红)。今天 = `"person"` | `"sla_timeout"` | `"policy"`。 */
 export type HostDecidedBy = HostDecision["decidedBy"];
 /**
- * 一次 decide 的事实,**一处成形**(两条 HTTP decide 腿 + 活卡 PARKED 赎回席共用)。
+ * ══ 决定体的出处位 `decidedBy`:一只闭集、一只读法、一只映射 ═══════════════════════════════════════════════
  *
- * `decidedBy` = 调用方**陈述**的决策者(缺席 ⇒ `"person"`,= 本面自古以来的形:一条不说话的 decide 就是
- * 一个人按的)。🔴 **本仓零判据**:词表的属主是 core,不认识的词由它 pre-CAS 响亮拒
- * (`checkpoint.invalid_outcome`,`hostDecision.decidedBy … is outside the closed set`)。在这里再判一次
- * 就是同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加第四个词就会被
- * 静默 400 掉 —— 那正是 #1016 的 `"policy"` 加进来时本可以发生的事。
+ * 规则一句话:**一个审批决定用一只键说是谁做的** —— `decidedBy ∈ {"person","policy"}`,缺席 = `"person"`;读它的只有
+ * {@link readDecidedBy}(三条工具审批决定口共读:live `POST /v1/tool-approvals/:id/respond`、耐久 ask 账
+ * `POST /v1/tasks/:id/asks/:askId/decision`、耐久 `POST /v1/approvals/:sessionId/decide`),把它交给引擎的只有
+ * {@link liveSettledBy}(同步座 `AskOutcome.settledBy`)与 {@link hostDecisionFacts}(停驻座 `hostDecision.decidedBy`)。
+ *  · 词与决定动词**正交**:策略可以放行也可以拒(core 7.39.0 起引擎铸 `policy_allowed` / `policy_refused`)。唯一的例外是
+ *    引擎自己的那一条 —— 一张要人的卡(`requiresRealApproval`)不归策略放行,见 {@link policyCannotAllow}。
+ *  · `"sla_timeout"` **永不从 wire 收**:那是「等待到点、没人答」,只有本服务自己的截止扫说得出来(`approval-sweeps.ts`
+ *    直接铸 `{decidedBy:"sla_timeout"}`,不经本读法)。调用方说它 = 替服务端伪证一件只有服务端看得见的事。
+ *  · `plan_review` 不读这只键:引擎的 plan_review 结局形没有决定者位(core 的结局规整会把别的键整只重建掉),收下它就是
+ *    一句「已记」的空话。那一门照兄弟门字段那一族拒(`approvals-assistant.ts` 的回决门族派生),候 core 给座。
+ *
+ * 词表的来源:core 包根**没有**导出这只词表的运行期常量(只有类型 `ResumeOutcome[...]["hostDecision"]["decidedBy"]`),所以
+ * 本仓一只闭集常量 + 两道编译期门**双向**咬着 core 的型:core 加 / 退一个词 ⇒ 这里先红,不会在 wire 上静默留一个两个座都已经
+ * 不收的词,也不会把 core 新开的词静默 400 掉。core 导出词表之日,本常量改为直接镜像那一只(请托在案)。
+ */
+export declare const APPROVAL_DECIDED_BY: readonly ["person", "policy"];
+/** wire 上的出处词(决定体 `decidedBy` 的值域)。 */
+export type ApprovalDecidedBy = (typeof APPROVAL_DECIDED_BY)[number];
+/** 闭集外的拒句(三条决定口同一句;码按各口既有约定,见 {@link readDecidedBy})。 */
+export declare const DECIDED_BY_OUTSIDE_CLOSED_SET = "decidedBy must be \"person\" or \"policy\" when present \u2014 who made this decision: a person, or this deployment's own policy (absent = \"person\"); \"sla_timeout\" is never accepted from a caller (only this server's own deadline sweep says a wait ended with nobody answering)";
+/** 直连门上的拒句(与 `remember` / `updatedInput` / `checkpointToken` 同族:键不在决策证明的签名载荷里)。 */
+export declare const DECIDED_BY_NOT_IN_PROOF = "decidedBy is not supported on a direct-door worker (not covered by the decision proof)";
+/** 一张要人的卡上策略的放行(三条决定口同一句;判据 {@link policyCannotAllow})。 */
+export declare const POLICY_CANNOT_ALLOW_PERSON_ASK = "decidedBy \"policy\" cannot allow this ask \u2014 it demands a person's approval (risk.requiresRealApproval), and a policy's answer is not a person's; answer it as a person, or refuse it as the policy";
+/**
+ * 退役键 `settledBy`(7.93.3–7.117.x 的「只配 deny」那一位)的拒句。耐久两口由各自的键闭集 / strict 体拒;live `/respond` 的解析不是
+ * 键闭集的(未知键一律忽略),而这只键不是随便一个未知键:它是调用方在**明确陈述**「这是策略答的」—— 忽略它就是把缺席律(person)
+ * 套在一个说了话的体上(旧壳的策略拒记成人拒;一张要人的卡上旧形的放行被读成人的放行,绕过 {@link policyCannotAllow})。所以那条口
+ * 在裁决之前响亮拒它,与同一只 parser 里 `scope` 的拒同一条先例;那只 parser 收成键闭集之日,这一臂并进闭集门。
+ */
+export declare const SETTLED_BY_RETIRED = "settledBy is retired \u2014 send decidedBy: \"person\" | \"policy\" (who made this decision; absent = \"person\"); ignoring it would record a policy's answer as a person's";
+/** {@link readDecidedBy} 的判决(调用点做穷举 `switch` + `never` 兜底,各按自己的码约定发出)。 */
+export type DecidedByReading = {
+    kind: "accepted";
+    decidedBy: ApprovalDecidedBy;
+} | {
+    kind: "not_in_proof";
+} | {
+    kind: "outside_closed_set";
+};
+/**
+ * 决定体 `decidedBy` 的**唯一读法**。次序即契约:
+ *  ① 缺席 ⇒ `"person"`(缺席律:一条不说话的决定就是一个人按的 —— 与修前逐字同形);
+ *  ② 直连门在场且键在场 ⇒ `not_in_proof`(不论值:它不在签名载荷里,能改线上字节的一方可以把人翻成策略;
+ *     第二参给字面 `false` 的调用点 = 那条口没有决策证明,live `/respond` 即此);
+ *  ③ 闭集内 ⇒ 那个词;其余一切(`"sla_timeout"`、结算词、别的串、非串、`null`)⇒ `outside_closed_set`。
+ */
+export declare function readDecidedBy(raw: unknown, directDoorActive: false): Exclude<DecidedByReading, {
+    kind: "not_in_proof";
+}>;
+export declare function readDecidedBy(raw: unknown, directDoorActive: boolean): DecidedByReading;
+/**
+ * **同步座的映射**(`AskOutcome.settledBy`;ask 账行的 `settled_by` 列存的也是这一格):`person` ⇒ 不铸键(引擎缺席即按人读,
+ * 与修前逐字同形 —— 人的放行仍是裸 `true`),`policy` ⇒ `"policy"`。总函数,无 cast。
+ */
+export declare function liveSettledBy(decidedBy: ApprovalDecidedBy): Extract<HostSettledBy, "policy"> | undefined;
+/**
+ * 引擎自己的那一条例外:**一张要人的卡不归策略放行**(core `policyCannotAnswer` / `unjudgedAllowRefused` —— 同步座上
+ * `req.requiresRealApproval === true` 时策略的 allow 被拒成 `blanket_allow_refused`)。本仓**只在自己的副作用先于引擎落地的
+ * 两条口**上于裁决之前说这一句(live `/respond`:会话放行 / 常驻规则 / 一条按 approve 回放的 DECIDED 行;耐久 ask 账:一条
+ * 宣称 approve 的 DECIDED 行),读的是引擎读的同一个事实(卡上的 `requiresRealApproval`)。耐久 `/decide` 不判:引擎在 CAS 之前
+ * 就拒(`checkpoint.invalid_outcome`,卡留 pending),本口的副作用全在引擎受理之后 —— 在那里再判一次就是第二个判官。
+ * core 包根没有导出这只谓词(请托在案);导出之日本函数改为直接调它。
+ */
+export declare function policyCannotAllow(decidedBy: ApprovalDecidedBy, allow: boolean, demandsAPerson: boolean): boolean;
+/**
+ * 一次 decide 的**停驻座事实**,一处成形(耐久 `/decide` 与活卡 PARKED 赎回席共用;截止扫直接铸 `{decidedBy:"sla_timeout"}`)。
+ *
+ * `decidedBy` = 已经过 {@link readDecidedBy} 的 wire 词:两个词在停驻座上**就是它自己**(`person` / `policy`,
+ * 两只词表的交集由上面的编译期门证),所以这里没有 cast,也没有缺席律(缺席已在读法里落成 `"person"`)。
  *
  * `principal` = 那条腿已经验过身份的决策者(缺席 = 匿名档的部署,通道确实没有名字可报)。
  * 归属串走 core 的 `screenApproverAttribution` **先筛后带**:core 对形不合的归属是 pre-CAS 响亮拒,
@@ -76,14 +140,8 @@ export type HostDecidedBy = HostDecision["decidedBy"];
  * 被改造过的串):归属是转录,不是可以「修一修」的东西 —— 修出来的名字既不是通道报的那个,也不是
  * 「通道没报」,两头都不真。
  *
- * 🔴 归属**不按词分岔**:core 7.38.x 的 `policy_refused` 结算记录上没有归属席(`who.party:"none"`),7.39.0 #1265 起有了
- * (`who.party:"policy"`,`approver?`)—— 无论 core 的记录怎么写,**本服务观察到的事实**不变:送出这次请求的那把已验证身份是真的,本仓的
+ * 🔴 归属**不按词分岔**:无论 core 的记录怎么写,**本服务观察到的事实**不变:送出这次请求的那把已验证身份是真的,本仓的
  * 迟到结算账本(`approval-ask-audit-store.ts`)记的就是它。按词删一格 = 给账本挖一个只在某个词上出现的洞。
- *
- * 🔴 **入参是 `string`,不是 `HostDecidedBy` —— 这一格刻意让类型说真话**(wire 边界强类型宪法):两条
- * decide 腿能证得出的只有「调用方给了个串」(形门在各自的口上),**证不出**它是词表成员;把参数声明成
- * 闭集就是让类型替一件本层从没做过的检查背书。⇒ 收 `string`,在**这一处**(本座的边界)做唯一一次 cast,
- * 而那次 cast 说的是「我把一个未判词的串放到只收词的座上,判词的是座的属主(core,pre-CAS 响亮拒)」。
  */
-export declare function hostDecisionFacts(decidedBy: string | undefined, principal: string | undefined): HostDecision;
+export declare function hostDecisionFacts(decidedBy: ApprovalDecidedBy, principal: string | undefined): HostDecision;
 //# sourceMappingURL=host-decision.d.ts.map

package/dist/host-decision.js

@@ -1,6 +1,36 @@
 import { screenApproverAttribution } from "@sema-agent/core";
+export const APPROVAL_DECIDED_BY = ["person", "policy"];
+export const DECIDED_BY_OUTSIDE_CLOSED_SET = 'decidedBy must be "person" or "policy" when present — who made this decision: a person, or this deployment\'s own policy (absent = "person"); "sla_timeout" is never accepted from a caller (only this server\'s own deadline sweep says a wait ended with nobody answering)';
+export const DECIDED_BY_NOT_IN_PROOF = "decidedBy is not supported on a direct-door worker (not covered by the decision proof)";
+export const POLICY_CANNOT_ALLOW_PERSON_ASK = 'decidedBy "policy" cannot allow this ask — it demands a person\'s approval (risk.requiresRealApproval), and a policy\'s answer is not a person\'s; answer it as a person, or refuse it as the policy';
+export const SETTLED_BY_RETIRED = 'settledBy is retired — send decidedBy: "person" | "policy" (who made this decision; absent = "person"); ignoring it would record a policy\'s answer as a person\'s';
+function isApprovalDecidedBy(v) {
+    return APPROVAL_DECIDED_BY.includes(v);
+}
+export function readDecidedBy(raw, directDoorActive) {
+    if (raw === undefined)
+        return { kind: "accepted", decidedBy: "person" };
+    if (directDoorActive)
+        return { kind: "not_in_proof" };
+    return isApprovalDecidedBy(raw) ? { kind: "accepted", decidedBy: raw } : { kind: "outside_closed_set" };
+}
+export function liveSettledBy(decidedBy) {
+    switch (decidedBy) {
+        case "person":
+            return undefined;
+        case "policy":
+            return "policy";
+        default: {
+            const unreachable = decidedBy;
+            throw new Error(`liveSettledBy: unknown decidedBy ${String(unreachable)}`);
+        }
+    }
+}
+export function policyCannotAllow(decidedBy, allow, demandsAPerson) {
+    return decidedBy === "policy" && allow && demandsAPerson;
+}
 export function hostDecisionFacts(decidedBy, principal) {
     const screened = screenApproverAttribution(principal);
-    return { decidedBy: (decidedBy ?? "person"), ...(screened.approver !== undefined ? { approver: screened.approver } : {}) };
+    return { decidedBy, ...(screened.approver !== undefined ? { approver: screened.approver } : {}) };
 }
 //# sourceMappingURL=host-decision.js.map

package/dist/http/admission.js

@@ -1,4 +1,4 @@
-import { MCP_IMAGE_MAX_BASE64, isThinkingLevel, expandTiers } from "@sema-agent/core";
+import { APPROVAL_REACH, MCP_IMAGE_MAX_BASE64, isApprovalReach, isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
@@ -14,6 +14,7 @@ import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
 import { resolveDevicePlacementIntent } from "./device-placement.js";
 import { sendError, httpErrorCode } from "./send.js";
+const APPROVAL_REACH_WORDS = APPROVAL_REACH.map((word) => JSON.stringify(word)).join(" / ");
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
 export const MAX_SYSTEM_PROMPT_CHARS = 16_384;
 export const MAX_OUTPUT_SCHEMA_CHARS = 32_768;
@@ -470,6 +471,11 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.field_invalid", "interactiveTools must be a boolean");
             return null;
         }
+        const approvalReach = body.approvalReach;
+        if (approvalReach !== undefined && !isApprovalReach(approvalReach)) {
+            sendError(res, 400, "request.field_invalid", `approvalReach must be ${APPROVAL_REACH_WORDS} when present (the run declares that nobody on it can be asked to approve; omit the key otherwise)`);
+            return null;
+        }
         if (body.oneShot !== undefined && typeof body.oneShot !== "boolean") {
             sendError(res, 400, "request.field_invalid", "oneShot must be a boolean");
             return null;

package/dist/http/approval-sweeps.js

@@ -150,7 +150,7 @@ export function createApprovalSweeps(ctx) {
             ...(req.gateBoundInputHash !== null ? { boundInputHash: req.gateBoundInputHash } : {}),
             ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
         };
-        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.settledBy, req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
+        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.decidedBy, req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
         return { status: out.status, body: out.body };
     }
     return { denyExpiredApprovals, redeemParkedAsk };

package/dist/http/mcp-dial-deadline.d.ts

@@ -0,0 +1,35 @@
+/**
+ * S-431 —— 一条 HTTP 请求愿意等**一次远端 MCP 拨号**多久:**一只数、一只 helper**,两口共读。
+ *
+ * 同一类动作(连一台远端 MCP 服务器 + 列它的工具)在本仓有两张 HTTP 面:
+ *  · `GET /v1/sessions/:id/mcp` 面板(`routes/sessions.ts`)—— 物化部署缺省场景的申报,到点答 200 `degraded:true`;
+ *  · `POST /v1/sessions/:id/mcp/reconnect`(`routes/mcp-reconnect.ts`)—— 在飞 run 上重拨一台,到点答 503。
+ * 修前面板有期限、reconnect 是裸 `await`(S-431):同一件事两个读法,一台拨不通 / 半开的远端能把后者挂很久。
+ * 两口各自**到点答什么**不同(面板是只读的部署面,有一个诚实的空形;reconnect 是一次交易,没有结果就没有
+ * 一个能当 `outcome` 的词)—— 但**等多久**是一个事实,所以只有一个数。
+ *
+ * 🔴 **这是常量,不是旋钮**:没有 env、不进 config-catalog。要调窗就改这一处,两口一起动。
+ * (底层拨号自己的上界是 core 的启动期钟 —— env `MCP_TIMEOUT`,未设落 SDK 缺省 —— 与本数无关:本数只界
+ * **HTTP 应答**,不界拨号;见 {@link raceDeadline}。)
+ *
+ * helper 收的是期限**参数**而不是自己读上面那个常量:调用点把 {@link MCP_DIAL_DEADLINE_MS} 显式交下来,
+ * `test/mcp-reconnect-deadline.test.ts` 的静态钉就是「每个远端 MCP 拨号调用点都把它交给 `raceDeadline`」。
+ */
+/** 一次远端 MCP 拨号的 HTTP 应答期限(毫秒)。面板与 reconnect 共读;**全仓只有这一处写它**。 */
+export declare const MCP_DIAL_DEADLINE_MS = 10000;
+/** `work` 没在期限内落定。**具名型**:调用腿据它分诊,不比对错误文案。 */
+export declare class DeadlineExceeded extends Error {
+    readonly boundMs: number;
+    constructor(boundMs: number);
+}
+/**
+ * 让**应答**不再等 `work`:`work` 先落定就原样交出(resolve / reject 都不变形),期限先到就 reject
+ * {@link DeadlineExceeded}。
+ *
+ * 🔴 **只界应答,不取消 `work`**:本函数不持有任何取消把手 —— core 的 `TaskStream.reconnectMcpServer` 与
+ * `materializeMcpTools` 都不收 `AbortSignal`(d.ts 逐字),所以期限到点后底层拨号**继续跑**,落定时
+ * 才释放它占的连接 / 子进程。调用点必须把这句话交代给调用方(reconnect 的 503 文案、契约 §G.7c)。
+ * 迟到的落定(尤其迟到的 reject)挂一条吞掉,免得没人 await 它时变成未处理拒绝。
+ */
+export declare function raceDeadline<T>(work: Promise<T>, deadlineMs: number): Promise<T>;
+//# sourceMappingURL=mcp-dial-deadline.d.ts.map

package/dist/http/mcp-dial-deadline.js

@@ -0,0 +1,21 @@
+export const MCP_DIAL_DEADLINE_MS = 10_000;
+export class DeadlineExceeded extends Error {
+    boundMs;
+    constructor(boundMs) {
+        super(`did not settle within ${boundMs}ms`);
+        this.boundMs = boundMs;
+        this.name = "DeadlineExceeded";
+    }
+}
+export function raceDeadline(work, deadlineMs) {
+    let timer;
+    const deadline = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new DeadlineExceeded(deadlineMs)), deadlineMs);
+    });
+    work.catch(() => undefined);
+    return Promise.race([work, deadline]).finally(() => {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    });
+}
+//# sourceMappingURL=mcp-dial-deadline.js.map

package/dist/http/memory-compliance-failure-reply.d.ts

@@ -10,21 +10,24 @@
  *
  * ## 规则(三层,与 operator 面既有层序逐字同序)
  *  ① core 的**本口专属**码(闭集穷举 `switch`,见 {@link sentCoreCode})—— 码与状态两面同;文案按受众(下一节,一条规则);
- *  ② `memory.target_outside_store`(core 7.31.1 #1094 跨面 store 状态码)—— 409;
+ *  ② **店形拒**两码 `memory.target_outside_store`(core 7.31.1 #1094)/ `memory.scope_home_not_directory`(core 7.44.0 #1368)—— 跨面 store 状态码,409、码原样
+ *     (判据 `memory-store-refusal.ts` 一只;运维行 `memory_store_form_refused { code, path?, form? }` 两受众同一只铸点,路径只在那里);
  *  ③ `ControlPlaneCorruptError` —— typed 500 `internal.memory_control_plane_corrupt`(fail-closed 信号,一码两义见下);
  *  其余 ⇒ `false`(未分类,调用方发它自己那句 500 且**不回显**内部文本)。
  *
  * ## 文案按受众分(码与状态不分)—— **一条规则,三层同施,不按码挑**(F9,7.108.0 合并复审 opus 腿 O-9)
- * core 原句是写给运维的诊断材料:② ③ 点名**宿主路径**(store 根、链解析到哪 / 控制面账本文件),① 的 `selector_mismatch` 带**首个请求的
+ * core 原句是写给运维的诊断材料:③ 点名**宿主路径**(控制面账本文件;② 自 core 7.44.0 起句子不带路径、路径在 `detail.path` ⇒ 运维行),① 的 `selector_mismatch` 带**首个请求的
  * 选择子哈希**(`pinned set <selectHash>`,无盐 sha256 —— operator 选择子可字典还原,首个请求未必是这位会话所有者发的):
  *  · operator 受众 ⇒ 原句上 wire(过了 operator 门,这些材料对这个受众不是泄露);
  *  · 会话所有者受众 ⇒ **一律**一句固定指路(每码一句,只说「怎么办」),原句整句交 `withheld` 落运维 warn —— 不逐码判断哪句安全
  *    (逐码挑 = core 改一句文案就可能静默漏出一样新东西)。② ③ 的固定句**两形都真**:
- *    ② 链先于请求在场 ⇒ 提交点之前拒、什么都没做;提交点之后才换上的链 ⇒ 已删的几条算数、journal 留盘(codex 一审 C1);
+ *    ② 链先于请求在场 ⇒ 提交点之前拒、什么都没做;提交点之后才换上的链 ⇒ 已删的几条算数、journal 留盘(codex 一审 C1);scope home 不是真目录那一句
+ *       同样不许诺零删除(home 被换掉的时刻本层判不出),只指路「运维放回真目录后用同一个 requestId 重发」;
  *    ③ 一码两义 —— 操作前账本读不出 ⇒ 什么都没发生;落定后残留枚举失败 ⇒ 抹除已提交、重放收敛(core 原话)。两句都不许诺零删除,
  *    都指路「运维修好后用同一个 requestId 重发」(两义下这句都对)。本层**不**嗅 core 文案分辨前后(拿上游自由文本当判别式是第二真源)。
  */
 import type { ServerResponse } from "node:http";
+import type { Logger } from "../observability/logger.js";
 /**
  * 已分类拒 → HTTP 状态的**唯一**码表 = 自铸 wire 值登记处的 `sessionMemoryEraseStatus` 集(F3:wire 变更清单从同一张表 diff,状态改一处、
  * 清单跟着列)。两面同读(S-930:码与状态只判一次)。键写错 ⇒ tsc 红(索引的是 `as const` 表的键)。
@@ -36,6 +39,9 @@ export type MemoryComplianceAudience = {
     readonly kind: "session_owner";
     readonly withheld: (coreMessage: string) => void;
 };
-/** 按上面三层应答;返回 `true` = 已应答,`false` = 未分类(一个字节都没写,调用方发它自己那句 500 并落它自己的运维 warn)。 */
-export declare function sentMemoryComplianceFailure(res: ServerResponse, err: unknown, audience: MemoryComplianceAudience): boolean;
+/**
+ * 按上面三层应答;返回 `true` = 已应答,`false` = 未分类(一个字节都没写,调用方发它自己那句 500 并落它自己的运维 warn)。
+ * `logger` = 店形拒那一条运维行的去处(两受众同一只;缺席 ⇒ 不落)。
+ */
+export declare function sentMemoryComplianceFailure(res: ServerResponse, err: unknown, audience: MemoryComplianceAudience, logger: Pick<Logger, "warn"> | undefined): boolean;
 //# sourceMappingURL=memory-compliance-failure-reply.d.ts.map

package/dist/http/memory-compliance-failure-reply.js

@@ -1,5 +1,5 @@
 import { ControlPlaneCorruptError } from "@sema-agent/core";
-import { targetOutsideStoreOf } from "../memory-store-refusal.js";
+import { logStoreFormRefusal, storeFormRefusalOf } from "../memory-store-refusal.js";
 import { sentMemoryStoreRefusal } from "./memory-store-refusal-reply.js";
 import { sendError } from "./send.js";
 import { assertNever } from "./route-ctx.js";
@@ -38,19 +38,28 @@ function codeOf(err) {
     const { code } = err;
     return typeof code === "string" ? code : undefined;
 }
-export function sentMemoryComplianceFailure(res, err, audience) {
+export function sentMemoryComplianceFailure(res, err, audience, logger) {
     const coreCode = codeOf(err);
     if (coreCode !== undefined && sentCoreCode(res, coreCode, err instanceof Error ? err.message : String(err), audience))
         return true;
-    const outside = targetOutsideStoreOf(err);
-    if (outside !== undefined) {
+    const storeForm = storeFormRefusalOf(err);
+    if (storeForm !== undefined) {
         switch (audience.kind) {
             case "operator":
-                return sentMemoryStoreRefusal(res, err);
+                return sentMemoryStoreRefusal(res, err, logger);
             case "session_owner":
-                audience.withheld(outside.message);
-                sendError(res, 409, "memory.target_outside_store", "session memory erasure refused — a directory in this deployment's memory store leads outside it (a link), so this erasure did not complete (a refusal before its commit point changed nothing; one after it keeps the deletions already made and a journal that finishes the rest once the link is removed); ask the operator to remove the link, then resend with the same requestId");
-                return true;
+                logStoreFormRefusal(logger, storeForm);
+                audience.withheld(storeForm.message);
+                switch (storeForm.code) {
+                    case "memory.target_outside_store":
+                        sendError(res, 409, "memory.target_outside_store", "session memory erasure refused — a directory in this deployment's memory store leads outside it (a link), so this erasure did not complete (a refusal before its commit point changed nothing; one after it keeps the deletions already made and a journal that finishes the rest once the link is removed); ask the operator to remove the link, then resend with the same requestId");
+                        return true;
+                    case "memory.scope_home_not_directory":
+                        sendError(res, 409, "memory.scope_home_not_directory", "session memory erasure refused — a scope directory in this deployment's memory store is not a real directory (it was replaced by a link or a file), so this erasure did not complete; ask the operator to put the real directory back, then resend with the same requestId");
+                        return true;
+                    default:
+                        return assertNever(storeForm.code);
+                }
             default:
                 return assertNever(audience);
         }

package/dist/http/memory-store-refusal-reply.d.ts

@@ -1,24 +1,27 @@
 /**
- * core 7.31.1 #1094 `memory.target_outside_store` 的 **operator 面 HTTP 映射** —— 唯一一处字面量(判据在
- * `src/memory-store-refusal.ts`)。挂在每一个触 store 树的 operator 记忆口的已分类收尾上:
+ * **店形拒**两码(`memory.target_outside_store` / `memory.scope_home_not_directory`,判据在 `src/memory-store-refusal.ts`)的
+ * **operator 面 HTTP 映射** + 两受众共用的**运维行** —— 唯一一处码字面量。挂在每一个触 store 树的 operator 记忆口的已分类收尾上:
  * `routes/memory-compliance.ts`(出处 / 抹除;经 `http/memory-compliance-failure-reply.ts` 的 operator 受众臂)· `routes/memory-origin.ts`(外源列表 / 清标;**不含**只读控制面的清标账列表 ——
  * core 的 wire 表逐字:只碰控制面的面不判,给它挂一条永远收不到的码路径正是附录 A 活触发门要防的形)·
- * `routes/memory-bundle.ts`(导出 / 导入)。会话所有者的自助抹除口**不走这里**(S-930 起经 `http/memory-compliance-failure-reply.ts` 的会话所有者受众臂:同码、固定文案)。
+ * `routes/memory-bundle.ts`(导出 / 导入)。会话所有者的自助抹除口**不走这里的 wire 句**(经 `http/memory-compliance-failure-reply.ts` 的会话所有者受众臂:同码、固定文案),
+ * 但运维行({@link logStoreFormRefusal},铸点在 `src/memory-store-refusal.ts`)两受众同一只。
  * `POST /v1/admin/memory/consolidation/run` 也不走这里:那口把 core 的**任何**有码拒一律收成 409 `memory.consolidation_refused`
- * (码进文案,附录 A 该行),本码已在那条臂上,不再给它第二个码。
+ * (码进文案,附录 A 该行),这一族已在那条臂上,不再给它第二个码。
  *
- * ## 为什么 409
- * core 的读法:operator 要处置的拒(去掉 store 里那只通到外面的目录链),不是可重试的 IO 故障,也不是对调用方的裁决。与
+ * ## 为什么 409(两码同一条)
+ * core 的读法:operator 要处置的盘形(去掉 store 里那只通到外面的目录链 / 把 scope home 放回真目录),不是可重试的 IO 故障,也不是对调用方的裁决。与
  * `memory.erasure_census_incomplete` 同一类(**当前 store 状态**下这次做不了;状态修好后重发即改判)⇒ 409,不 500(服务器没坏)、
  * 不 4xx 请求族(请求没写错)。抹除面:链先于请求在场 ⇒ core 在提交点之前拒,零删除、零 journal(真 core 格钉在
  * `test/memory-compliance-http.test.ts`);链在提交点之后才换上 ⇒ 已删的几条算数、journal 留盘 —— core 原句会带
  * `after the commit point; the journal is kept`,本层原样转发、不嗅它分类(codex 一审 C1)。
  *
- * ## 文案原样
- * core 的诊断句点名动作、路径与解析到哪 —— 那是运维找到那只链的唯一材料,与本族其它 core 码同一条「码与文案都不改写」纪律。
- * 只对 operator 面这么做:这几口都过了 operator 门,宿主路径对这个受众不是泄露。
+ * ## 文案原样,路径进运维行
+ * operator 面上 wire 的是 core 原句(码领头;core 7.44.0 起句子里**没有**宿主路径 —— 路径在 `detail.path`)。路径不上 wire(两受众同,裁定:运维腿的
+ * 句子不带服务器路径,路径只进日志):每次应答这一族,{@link logStoreFormRefusal} 落一条运维 warn `memory_store_form_refused { code, path?, form? }` ——
+ * 运维找到那只链 / 那只坏 home 的唯一材料。
  */
 import type { ServerResponse } from "node:http";
-/** `err` 是 `memory.target_outside_store` ⇒ 409 带码 + core 原句,返回 true(已应答);否则 false,一个字节都不写。 */
-export declare function sentMemoryStoreRefusal(res: ServerResponse, err: unknown): boolean;
+import type { Logger } from "../observability/logger.js";
+/** `err` 是店形拒 ⇒ 409 带码 + core 原句 + 运维行,返回 true(已应答);否则 false,一个字节都不写。 */
+export declare function sentMemoryStoreRefusal(res: ServerResponse, err: unknown, logger: Pick<Logger, "warn"> | undefined): boolean;
 //# sourceMappingURL=memory-store-refusal-reply.d.ts.map

package/dist/http/memory-store-refusal-reply.js

@@ -1,10 +1,21 @@
-import { targetOutsideStoreOf } from "../memory-store-refusal.js";
+import { logStoreFormRefusal, storeFormRefusalOf } from "../memory-store-refusal.js";
 import { sendError } from "./send.js";
-export function sentMemoryStoreRefusal(res, err) {
-    const refusal = targetOutsideStoreOf(err);
+export function sentMemoryStoreRefusal(res, err, logger) {
+    const refusal = storeFormRefusalOf(err);
     if (refusal === undefined)
         return false;
-    sendError(res, 409, "memory.target_outside_store", refusal.message);
-    return true;
+    logStoreFormRefusal(logger, refusal);
+    switch (refusal.code) {
+        case "memory.target_outside_store":
+            sendError(res, 409, "memory.target_outside_store", refusal.message);
+            return true;
+        case "memory.scope_home_not_directory":
+            sendError(res, 409, "memory.scope_home_not_directory", refusal.message);
+            return true;
+        default: {
+            const unhandled = refusal.code;
+            throw new Error(`unhandled store-form refusal word: ${String(unhandled)}`);
+        }
+    }
 }
 //# sourceMappingURL=memory-store-refusal-reply.js.map

package/dist/http/resume-legs.js

@@ -1,7 +1,7 @@
 import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { createHash } from "node:crypto";
 import { uuidv7, resumeWithVerification, CheckpointError, defaultTaskRegistry, taskNotificationDedupKey, validatePendingSteer, GLOBAL_USAGE_KEY, PAUSE_REGISTRY } from "@sema-agent/core";
-import { decideParkedAgent, denyWorkflowParksUnreadable, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
+import { decideParkedAgent, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
 const sessionFaceUnavailable = async (sessionId) => {
     throw new Error(`parked decide cannot verify which occupant session ${sessionId} belongs to: this deployment's session store has no sessionFaceOf read (every built-in store has one) — refusing rather than resuming unverified`);
 };
@@ -15,7 +15,7 @@ import { recordResumeResourceWindow } from "../resource-window.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../fleet/subagent-tail-bus.js";
-import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerMayRetire } from "../tool-approval.js";
+import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerDurablyRecordable } from "../tool-approval.js";
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { withPrincipal } from "../observability/principal-context.js";
@@ -274,7 +274,7 @@ export function createResumeLegs(ctx) {
         const rememberableTool = paForGrant !== undefined &&
             paForGrant.toolName &&
             paForGrant.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
-            standingAnswerMayRetire(parkRowStandingAnswerFacts(paForGrant, cp.gate, deps.config))
+            standingAnswerDurablyRecordable(parkRowStandingAnswerFacts(paForGrant, cp.gate, deps.config))
             ? paForGrant.toolName
             : null;
         const boundGrant = onResumeCommitted
@@ -345,6 +345,10 @@ export function createResumeLegs(ctx) {
                 void ctxPromise.catch(() => { });
                 return denyWorkflowParksUnreadable(origin);
             }
+            if (origin?.kind === "workflow_park_forked") {
+                void ctxPromise.catch(() => { });
+                return denyWorkflowParkForked(origin);
+            }
             if (origin?.kind === "workflow") {
                 void ctxPromise.catch(() => { });
                 const plan = planWorkflowParkedDecide(origin, parkedReq);

package/dist/http/routes/approvals-assistant.js

@@ -1,8 +1,8 @@
 import { screenedGate } from "../../trace/project.js";
-import { hostDecisionFacts } from "../../host-decision.js";
+import { hostDecisionFacts, readDecidedBy, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
-import { APPROVAL_GATE_KINDS, SETTLED_BY_DENY_ONLY, SETTLED_BY_MUST_BE_STRING, SETTLED_BY_TOO_WIDE, judgeSettledByBody, standingAnswerMayRetire } from "../../tool-approval.js";
+import { APPROVAL_GATE_KINDS, standingAnswerDurablyRecordable } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
@@ -17,7 +17,7 @@ import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isOperator, sendPrincipalRefusal } from "../principal-gate.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
-import { answerGrantsBeyondCall } from "../../standing-answer-grant.js";
+import { answerGrantsBeyondCall, grantBindingOf } from "../../standing-answer-grant.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -25,10 +25,10 @@ import { readResumeCtx, resumeCtxCorruptAnswer } from "../resume-ctx-read.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 const DECIDE_BODY_DECLARED_KEYS = [
-    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decision", "reason", "remember", "settledBy", "updatedInput",
+    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decision", "reason", "remember", "updatedInput",
 ];
 const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
-const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "remember", "settledBy", "updatedInput"];
+const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "remember", "updatedInput"];
 const PLAN_REVIEW_BODY_DECLARED_KEYS = [
     "boundCallId", "decision", "editedPlan", "permissionModeAfter", "reason",
 ];
@@ -356,6 +356,9 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(s.mandate !== undefined ? { mandate: s.mandate } : {}),
                     ...(s.denialLimitFallback !== undefined ? { denialLimitFallback: s.denialLimitFallback } : {}),
                     ...(s.origin !== undefined ? { origin: s.origin } : {}),
+                    ...(s.boundGrantDigest !== undefined ? { boundGrantDigest: s.boundGrantDigest } : {}),
+                    ...(s.boundGrants !== undefined ? { boundGrants: s.boundGrants } : {}),
+                    ...(s.classifierNoRuling !== undefined ? { classifierNoRuling: s.classifierNoRuling } : {}),
                     objective,
                     input,
                 };
@@ -637,7 +640,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "deny" ? "deny" : undefined;
             if (!decision) {
-                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, settledBy? }");
+                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, decidedBy? }");
                 return;
             }
             {
@@ -708,29 +711,22 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "checkpoint_token_not_in_proof", "checkpointToken is not supported on a direct-door worker (not covered by the decision proof); bind the decision with boundCallId and boundInputHash instead");
                 return;
             }
-            const settledByVerdict = judgeSettledByBody(body.settledBy, decision, deps.config.directDoorActive);
-            switch (settledByVerdict.kind) {
+            const decidedByReading = readDecidedBy(body.decidedBy, deps.config.directDoorActive);
+            switch (decidedByReading.kind) {
                 case "not_in_proof":
-                    sendError(res, 400, "settled_by_not_in_proof", "settledBy is not supported on a direct-door worker (not covered by the decision proof)");
+                    sendError(res, 400, "decided_by_not_in_proof", DECIDED_BY_NOT_IN_PROOF);
                     return;
-                case "deny_only":
-                    sendError(res, 400, "request.field_conflict", SETTLED_BY_DENY_ONLY);
+                case "outside_closed_set":
+                    sendError(res, 400, "request.field_invalid", DECIDED_BY_OUTSIDE_CLOSED_SET);
                     return;
-                case "not_string":
-                    sendError(res, 400, "request.field_invalid", SETTLED_BY_MUST_BE_STRING);
-                    return;
-                case "too_wide":
-                    sendError(res, 400, "request.field_invalid", SETTLED_BY_TOO_WIDE);
-                    return;
-                case "absent":
                 case "accepted":
                     break;
                 default: {
-                    const unreachable = settledByVerdict;
-                    throw new Error(`unhandled settledBy verdict: ${JSON.stringify(unreachable)}`);
+                    const unreachable = decidedByReading;
+                    throw new Error(`unhandled decidedBy reading: ${JSON.stringify(unreachable)}`);
                 }
             }
-            const settledBy = settledByVerdict.kind === "accepted" ? settledByVerdict.settledBy : undefined;
+            const decidedBy = decidedByReading.decidedBy;
             const binding = {
                 checkpointToken: body.checkpointToken,
                 boundCallId: body.boundCallId,
@@ -779,7 +775,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };
                 }
                 : undefined;
-            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(settledBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
+            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(decidedBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
             const outErrorCode = out.body.errorCode;
             if (pendingGrant !== undefined && out.status === 200 && (outErrorCode !== "cancelled" || out.decisionCommitted === true) && deps.approvalExemptionStore) {
                 try {
@@ -826,11 +822,12 @@ function redactPendingDisclosures(row) {
 function projectPendingForWire(row, governance) {
     const redacted = redactPendingDisclosures(row);
     const governanceForced = governanceOriginOf({ riskDescriptor: row.riskDescriptor ?? undefined }, governance);
-    const rememberRefused = !standingAnswerMayRetire({
+    const rememberRefused = !standingAnswerDurablyRecordable({
         governanceForced: governanceForced === true,
         requiresRealApproval: row.requiresRealApproval === true,
         mandated: row.mandated === true || row.ruleOffersAbsence === "mandated",
-        grantsBeyondCall: answerGrantsBeyondCall(row),
+        grantBinding: grantBindingOf(row),
+        classes: row.classes,
     });
     return { ...redacted, ...(governanceForced ? { governanceForced } : {}), ...(rememberRefused ? { rememberRefused: true } : {}) };
 }

package/dist/http/routes/capabilities.js

@@ -137,6 +137,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 taskAgents: deps.config.requirePrincipal !== true,
                 retainBackgroundProcesses: deps.config.requirePrincipal !== true,
                 interactiveTools: true,
+                approvalReach: true,
                 disableSkills: true,
                 userInvokedSkills: true,
                 skillToolLists: true,
@@ -158,6 +159,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 approvalsStreamLive: projectApprovalsStreamLiveCapability(deps),
                 streamApproval: facts.streamApproval(deps).available,
                 approvalDecisionNote: true,
+                approvalDecidedBy: true,
                 sideQuery: true,
                 agentRoster: facts.agentRoster(deps).available,
                 retention: retentionAdvertisement(deps.config),