@sema-agent/server 7.117.0 → 7.119.0

package/dist/tool-approval.js

@@ -1,6 +1,7 @@
 import { contentKindOf } from "./approval-content-kind.js";
+import { heldAskOf, liveSettledBy, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "./host-decision.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
+import { uuidv7, classifyAsk, foldArbitrationRow, policyCannotAnswer, screenAskClassMembers, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
 import { redactDeep, redactSecrets, redactSecretsWithArms } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -9,11 +10,13 @@ import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
 import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readRuleEvidence, readAllowRuleShadowed, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
-import { MAX_SETTLED_BY_CHARS, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, settledByFitsColumn } from "./plugins/approval-ask-store-sql.js";
+import { POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 import { governanceOriginOf } from "./runtime-governance.js";
-import { answerGrantsBeyondCall } from "./standing-answer-grant.js";
+import { answerGrantsBeyondCall, grantBindingOf } from "./standing-answer-grant.js";
+import { operatorAsk } from "./operator-ask.js";
+import { APPROVAL_EXEMPTED_EVENT } from "./plugins/approval-exemption-store.js";
 const defaultLogger = createLogger();
 export const APPROVAL_GATE_KINDS = ["human", "irreversible_ask"];
 export function isApprovalGateKind(k) {
@@ -53,7 +56,7 @@ function durableRuleMaterial(material) {
 export const ASK_DECISION_CONSUMER_ABSENT = "absent";
 const MAX_INFLIGHT_TERMINAL_CLAIMS = 2;
 const DURABLE_CONVERGE_BACKOFF_MS = [50, 100, 200, 400, 800, 1600];
-const DURABLE_CONVERGE_READ_TIMEOUT_MS = 2_000;
+export const DURABLE_CONVERGE_READ_TIMEOUT_MS = 2_000;
 const DURABLE_CALL_TIMEOUT_MS = 5_000;
 const TERMINAL_LADDER_WALL_MS = DURABLE_CALL_TIMEOUT_MS + DURABLE_CONVERGE_READ_TIMEOUT_MS + DURABLE_CONVERGE_BACKOFF_MS.reduce((a, b) => a + b, 0);
 const TERMINAL_CLAIM_CAP_POLL_MS = 50;
@@ -81,19 +84,68 @@ const FS_WRITE_TOOLS = pathConfinableWriteToolNames();
 function sessionAllowCategory(toolName) {
     return FS_WRITE_TOOLS.has(toolName) ? "fs-write" : `tool:${toolName}`;
 }
-function sessionAllowKey(owner, sessionId, category) {
-    return JSON.stringify([owner, sessionId, category]);
+function sessionAllowKey(owner, sessionId, category, binding) {
+    return JSON.stringify([owner, sessionId, category, binding.kind === "bound" ? binding.digest : null]);
 }
-export function standingAnswerMayRetire(facts) {
-    return !facts.governanceForced && !facts.requiresRealApproval && !facts.mandated && !facts.grantsBeyondCall;
+function askStandingAnswerFacts(req, governanceForced, deploymentListAsks) {
+    const classes = screenAskClassMembers(req.askClass, req.classes)?.classes;
+    return {
+        governanceForced,
+        requiresRealApproval: req.requiresRealApproval === true,
+        mandated: req.mandated === true,
+        grantBinding: grantBindingOf(req),
+        classes,
+        deploymentListQuestion: carriesDeploymentListQuestion(deploymentListAsks, classes),
+    };
+}
+const NO_GATE_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} };
+const DEPLOYMENT_LIST_ASK_CLASSES = new Set(classifyAsk(operatorAsk("APPROVAL_REQUIRE", ""), NO_GATE_FACTS).classes);
+export function carriesDeploymentListQuestion(deploymentListAsks, classes) {
+    return deploymentListAsks && classes !== undefined && classes.some((c) => DEPLOYMENT_LIST_ASK_CLASSES.has(c));
+}
+export function policyAskStandingAnswerFacts(req, ask, deploymentListQuestion) {
+    return {
+        governanceForced: false,
+        requiresRealApproval: ask.requiresRealApproval === true,
+        mandated: ask.mandated === true,
+        grantBinding: grantBindingOf(req),
+        classes: [...classifyAsk(ask, NO_GATE_FACTS).classes],
+        deploymentListQuestion,
+    };
 }
-export function parkRowStandingAnswerFacts(pending, gate, governance) {
+export function standingAnswerHome(facts) {
+    if (facts.governanceForced || facts.requiresRealApproval || facts.mandated || facts.classes === undefined)
+        return "none";
+    if (facts.deploymentListQuestion) {
+        return facts.grantBinding.kind === "none" && facts.classes.every((c) => DEPLOYMENT_LIST_ASK_CLASSES.has(c)) ? "server_store" : "none";
+    }
+    return facts.grantBinding.kind !== "unreadable" && foldArbitrationRow(new Set(facts.classes)).ruleMayClear ? "seat" : "none";
+}
+export function standingAnswerDurablyRecordable(facts) {
+    const home = standingAnswerHome(facts);
+    switch (home) {
+        case "none":
+            return false;
+        case "seat":
+            return facts.grantBinding.kind === "none";
+        case "server_store":
+            return true;
+        default: {
+            const unhandled = home;
+            throw new Error(`unhandled standing-answer home: ${String(unhandled)}`);
+        }
+    }
+}
+export function parkRowStandingAnswerFacts(pending, gate, governance, deploymentListAsks) {
     const riskDescriptor = "riskDescriptor" in gate ? gate.riskDescriptor : undefined;
+    const classes = screenAskClassMembers(pending.askClass, pending.classes)?.classes;
     return {
         governanceForced: governanceOriginOf({ riskDescriptor }, governance) === true,
         requiresRealApproval: readParkRowTrueSeat(pending, "requiresRealApproval"),
         mandated: readParkRowTrueSeat(pending, "mandated") || mandatedFromSeat(readRuleOffersAbsenceSeat(pending)),
-        grantsBeyondCall: answerGrantsBeyondCall(pending),
+        grantBinding: grantBindingOf(pending),
+        classes,
+        deploymentListQuestion: carriesDeploymentListQuestion(deploymentListAsks, classes),
     };
 }
 function pendingEntryStandingAnswerFacts(entry) {
@@ -101,7 +153,9 @@ function pendingEntryStandingAnswerFacts(entry) {
         governanceForced: entry.governanceForced === true,
         requiresRealApproval: entry.requiresRealApproval === true,
         mandated: entry.mandated === true,
-        grantsBeyondCall: answerGrantsBeyondCall(entry),
+        grantBinding: entry.grantBinding,
+        classes: entry.classes,
+        deploymentListQuestion: entry.deploymentListQuestion === true,
     };
 }
 function mandatedFromSeat(seat) {
@@ -118,29 +172,15 @@ export const PERSIST_RULE_TEXT_ERROR = `persistRule.rule must be a non-empty str
 export const PERSIST_RULE_EDITED_FLAG_ERROR = "persistRule.edited must be a boolean when present";
 export const PERSIST_RULE_BATCH_INDEX_ERROR = "persistRule.batchOfferIndex must be a non-negative integer when present";
 export const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOfferIndex is mutually exclusive with persistRule.rule / persistRule.edited — send exactly one arm";
-export const SETTLED_BY_MUST_BE_STRING = "settledBy must be a string — the settlement source is one word from the engine's closed set, and this layer judges only the SHAPE (which word it is, the engine decides)";
-export function respondSettledBy(parsed) {
-    return parsed.settledBy;
-}
-export const SETTLED_BY_DENY_ONLY = 'settledBy is only meaningful with decision "deny" — only a person approves an action that EXECUTES, so a self-reported settlement source on an allow is a contradiction the engine refuses; the refusal would arrive too late to undo this door\'s own side effects (a session allow-all grant, a persisted rule, a DECIDED row that replays as a plain approval), so it is refused here, before the decision';
-export const SETTLED_BY_TOO_WIDE = `settledBy must be 1-${MAX_SETTLED_BY_CHARS} characters — the settlement source is one word from the engine's closed set and lands in a fixed-width column on the decision row`;
-export function judgeSettledByBody(settledBy, decision, directDoorActive) {
-    if (settledBy === undefined)
-        return { kind: "absent" };
-    if (directDoorActive)
-        return { kind: "not_in_proof" };
-    if (decision !== "deny")
-        return { kind: "deny_only" };
-    if (typeof settledBy !== "string")
-        return { kind: "not_string" };
-    if (!settledByFitsColumn(settledBy))
-        return { kind: "too_wide" };
-    return { kind: "accepted", settledBy };
-}
 export const READ_ROOT_GRANT_ALLOW_ONLY = 'readRootGrant is only meaningful with decision "allow" — it is the card\'s "Yes, and add directory" answer (allow this call and add the card\'s readRootCandidate.dir to this run\'s read directories)';
 export const READ_ROOT_GRANT_SHAPE = `readRootGrant must be the card's readRootCandidate.dir sent back byte for byte — a non-empty string of at most ${READ_ROOT_CANDIDATE_DIR_MAX} characters`;
 export const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope — the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
 export function parseToolApprovalResponse(body) {
+    const retired = retiredDecisionKeyFacts(body);
+    const parsed = parseToolApprovalFields(body, retired);
+    return parsed.ok || retired === undefined ? parsed : { ...parsed, ...retired.extra };
+}
+function parseToolApprovalFields(body, retired) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
         return { ok: false, error: "body must be an object" };
     const d = body.decision;
@@ -183,23 +223,19 @@ export function parseToolApprovalResponse(body) {
             }
             note = rawNote;
         }
-        const settledByVerdict = judgeSettledByBody(body.settledBy, d, false);
-        let settledBy;
-        switch (settledByVerdict.kind) {
-            case "deny_only":
-                return { ok: false, error: SETTLED_BY_DENY_ONLY };
-            case "not_string":
-                return { ok: false, error: SETTLED_BY_MUST_BE_STRING };
-            case "too_wide":
-                return { ok: false, error: SETTLED_BY_TOO_WIDE };
-            case "absent":
-                break;
+        if (retired !== undefined)
+            return { ok: false, error: retired.error };
+        const decidedByReading = readDecidedBy(body.decidedBy, false);
+        let decidedBy;
+        switch (decidedByReading.kind) {
+            case "outside_closed_set":
+                return { ok: false, error: DECIDED_BY_OUTSIDE_CLOSED_SET };
             case "accepted":
-                settledBy = settledByVerdict.settledBy;
+                decidedBy = decidedByReading.decidedBy;
                 break;
             default: {
-                const unreachable = settledByVerdict;
-                throw new Error(`unhandled settledBy verdict: ${JSON.stringify(unreachable)}`);
+                const unreachable = decidedByReading;
+                throw new Error(`unhandled decidedBy reading: ${JSON.stringify(unreachable)}`);
             }
         }
         const rawGrant = body.readRootGrant;
@@ -214,7 +250,7 @@ export function parseToolApprovalResponse(body) {
             ...(d !== "deny" && u !== undefined ? { updatedInput: u } : {}),
             ...(persistRule !== undefined ? { persistRule } : {}),
             ...(note !== undefined ? { note } : {}),
-            ...(settledBy !== undefined ? { settledBy } : {}),
+            decidedBy,
             ...(readRootGrant !== undefined ? { readRootGrant } : {}),
         };
     }
@@ -310,9 +346,10 @@ function replayTerminalAskRow(row) {
     return false;
 }
 export function outcomeOfDecidedRow(row) {
-    if (row.decision !== "approve")
-        return row.settledBy !== null ? { allow: false, settledBy: row.settledBy } : false;
-    return row.updatedInput !== undefined ? { allow: true, updatedInput: row.updatedInput } : true;
+    const allow = row.decision === "approve";
+    const source = row.settledBy !== null ? { settledBy: row.settledBy } : {};
+    const edit = allow && row.updatedInput !== undefined ? { updatedInput: row.updatedInput } : {};
+    return row.settledBy === null && !("updatedInput" in edit) ? allow : { allow, ...edit, ...source };
 }
 function settleArgsOfDecided(outcome) {
     if (typeof outcome === "boolean")
@@ -379,6 +416,7 @@ export class ToolApprovalCoordinator {
     parkedRedeem;
     askAudit;
     sessionGrants;
+    deploymentListAsks;
     shutdownDraining = false;
     asksInFlight = 0;
     parkCommits;
@@ -400,6 +438,10 @@ export class ToolApprovalCoordinator {
         this.parkTombstonePerPrincipalMax = opts?.parkTombstonePerPrincipalMax ?? DEFAULT_PARK_TOMBSTONE_PER_PRINCIPAL_MAX;
         this.askAudit = opts?.askAudit;
         this.sessionGrants = opts?.sessionGrants;
+        if (opts?.deploymentListAsks !== undefined && opts.sessionGrants === undefined) {
+            throw new Error("ToolApprovalCoordinator: deploymentListAsks needs sessionGrants — the deployment list's standing answers live in the session exemption store");
+        }
+        this.deploymentListAsks = opts?.deploymentListAsks;
         this.parkCommits = opts?.parkCommits;
         this.parkCommits?.onParkCommitted((calls) => this.noteParkCommitted(calls));
     }
@@ -751,19 +793,30 @@ export class ToolApprovalCoordinator {
         return (this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(origin.owner, origin.sessionId, origin.taskId))).isMarked(req.toolCallId);
     }
     async standingGrantSettles(origin, req, governanceForced) {
-        if (!standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true, grantsBeyondCall: answerGrantsBeyondCall(req) }))
-            return false;
+        const facts = askStandingAnswerFacts(req, governanceForced, this.deploymentListAsks?.(req) === true);
+        const home = standingAnswerHome(facts);
+        switch (home) {
+            case "seat":
+                break;
+            case "none":
+            case "server_store":
+                return false;
+            default: {
+                const unhandled = home;
+                throw new Error(`unhandled standing-answer home: ${String(unhandled)}`);
+            }
+        }
         const sessionId = origin.sessionId;
         if (!sessionId)
             return false;
-        const live = this.allowAllSessions.has(sessionAllowKey(origin.owner, sessionId, sessionAllowCategory(req.toolName)));
-        const durable = !live && (await this.durableGrantHas(sessionId, req.toolName));
+        const live = this.allowAllSessions.has(sessionAllowKey(origin.owner, sessionId, sessionAllowCategory(req.toolName), facts.grantBinding));
+        const durable = !live && !answerGrantsBeyondCall(req) && (await this.durableGrantHas(sessionId, req.toolName));
         if (!live && !durable)
             return false;
         if (!(await this.sessionGrantUncontestedByRow(origin, req)))
             return false;
         if (durable)
-            defaultLogger.info("approval_exempted", { sessionId, toolName: req.toolName, seat: "approval_seat" });
+            defaultLogger.info(APPROVAL_EXEMPTED_EVENT, { sessionId, toolName: req.toolName, seat: "approval_seat" });
         return true;
     }
     async durableGrantHas(sessionId, canonicalToolName) {
@@ -1044,6 +1097,7 @@ export class ToolApprovalCoordinator {
         if (signal?.aborted)
             return false;
         const governanceForced = this.governanceForcedOf(origin, req);
+        const deploymentListAsks = this.deploymentListAsks?.(req) === true;
         if (await this.standingGrantSettles(origin, req, governanceForced))
             return true;
         const aliveCtxs = ctxs.filter((c) => !c.abortSignal?.aborted);
@@ -1071,6 +1125,7 @@ export class ToolApprovalCoordinator {
         let effectiveGovernanceForced = governanceForced;
         let ruleLaneMaterial = this.buildRuleLaneMaterial(req, origin.owner, governanceForced, origin.sessionId);
         const mandateWord = readClosedWordSeat(req, "mandate");
+        const noRulingCause = readClosedWordSeat(req, "classifierNoRuling");
         const originWord = typeof req.origin === "string" && req.origin.length > 0 ? req.origin : undefined;
         const askClassPair = readAskClassPair(req);
         const frame = {
@@ -1098,7 +1153,9 @@ export class ToolApprovalCoordinator {
             ...(governanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(req.mandated === true ? { mandated: true } : {}),
-            ...(standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true, grantsBeyondCall: answerGrantsBeyondCall(req) }) ? {} : { rememberRefused: true }),
+            ...(standingAnswerHome(askStandingAnswerFacts(req, governanceForced, deploymentListAsks)) === "none" ? { rememberRefused: true } : {}),
+            ...(typeof req.boundGrantDigest === "string" ? { boundGrantDigest: req.boundGrantDigest, ...(req.boundGrants !== undefined ? { boundGrants: req.boundGrants } : {}) } : {}),
+            ...(noRulingCause !== undefined ? { classifierNoRuling: noRulingCause } : {}),
             ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
             ...(originWord !== undefined ? { origin: originWord } : {}),
             ...(askClassPair ?? {}),
@@ -1306,11 +1363,12 @@ export class ToolApprovalCoordinator {
                 return unattended === "unavailable" ? unattended : shapeDeny(unattended);
             }
             if (settled.allowed) {
-                if (settled.updatedInput === undefined && settled.readRootGrant === undefined)
+                if (hostSettled === undefined && settled.updatedInput === undefined && settled.readRootGrant === undefined)
                     return true;
                 return {
                     allow: true,
                     ...(settled.updatedInput !== undefined ? { updatedInput: settled.updatedInput } : {}),
+                    ...(hostSettled !== undefined ? { settledBy: hostSettled } : {}),
                     ...(settled.readRootGrant !== undefined ? { readRootGrant: settled.readRootGrant } : {}),
                 };
             }
@@ -1623,12 +1681,17 @@ export class ToolApprovalCoordinator {
                 return shapeOutcome(await allowedP);
             }
         }
-        const rememberRefused = !standingAnswerMayRetire(pendingEntryStandingAnswerFacts({
+        const entryGrantBinding = grantBindingOf(req);
+        const entryClasses = askClassPair?.classes;
+        const entryDeploymentListQuestion = carriesDeploymentListQuestion(deploymentListAsks, entryClasses);
+        const rememberRefused = standingAnswerHome(pendingEntryStandingAnswerFacts({
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(req.mandated === true ? { mandated: true } : {}),
-            toolName: req.toolName,
-        }));
+            grantBinding: entryGrantBinding,
+            classes: entryClasses,
+            ...(entryDeploymentListQuestion ? { deploymentListQuestion: true } : {}),
+        })) === "none";
         if (rememberRefused)
             frame.rememberRefused = true;
         else
@@ -1648,6 +1711,9 @@ export class ToolApprovalCoordinator {
             ...(origin.sessionId ? { sessionId: origin.sessionId } : {}),
             frame,
             toolName: req.toolName,
+            grantBinding: entryGrantBinding,
+            ...(entryClasses !== undefined ? { classes: entryClasses } : {}),
+            ...(entryDeploymentListQuestion ? { deploymentListQuestion: true } : {}),
             registeredAtMs: Date.now(),
             expiresAtMs: persistedExpiresAtMs,
             ...(ruleLaneMaterial !== undefined ? { ruleLane: ruleLaneMaterial } : {}),
@@ -1777,7 +1843,7 @@ export class ToolApprovalCoordinator {
     respond(id, principal, body, httpReq) {
         const parsed = parseToolApprovalResponse(body);
         if (!parsed.ok)
-            return { status: 400, body: { error: parsed.error, errorCode: "request.body_shape" } };
+            return { status: 400, body: { error: parsed.error, errorCode: "request.body_shape", ...(parsed.field !== undefined ? { field: parsed.field } : {}) } };
         const entry = this.pending.get(id);
         if (!entry || (entry.owner !== null && entry.owner !== principal)) {
             return this.respondLate(id, principal, parsed, httpReq);
@@ -1785,14 +1851,43 @@ export class ToolApprovalCoordinator {
         const preRule = this.precheckEditedRuleBeforeDecision(entry, parsed);
         if (preRule !== undefined)
             return preRule;
+        if (parsed.value !== "deny" && policyCannotAnswer(heldAskOf(entry.requiresRealApproval === true), parsed.decidedBy)) {
+            return { status: 400, body: { error: POLICY_CANNOT_ALLOW_PERSON_ASK, errorCode: "request.body_shape" } };
+        }
         const ruleEligibility = { eligible: true };
-        const settled = this.askStore && entry.askId !== undefined && entry.batchId !== undefined
+        const decided = this.askStore && entry.askId !== undefined && entry.batchId !== undefined
             ? this.respondWithCas(this.askStore, entry.askId, entry.batchId, id, entry, parsed, ruleEligibility)
             : this.finishRespond(id, entry, parsed);
+        const settled = this.recordDeploymentListAnswer(decided, entry, parsed, principal, ruleEligibility);
         if (parsed.persistRule === undefined)
             return settled;
         return this.persistRuleAfterDecision(settled, entry, parsed.persistRule, parsed.updatedInput !== undefined, ruleEligibility);
     }
+    recordDeploymentListAnswer(decided, entry, parsed, principal, eligibility) {
+        const store = this.sessionGrants;
+        const sessionId = entry.sessionId;
+        if (parsed.value !== "allow_session" || !sessionId || store === undefined)
+            return decided;
+        if (standingAnswerHome(pendingEntryStandingAnswerFacts(entry)) !== "server_store")
+            return decided;
+        return (async () => {
+            const result = await decided;
+            if (result.status !== 200)
+                return result;
+            if (!eligibility.eligible)
+                return { ...result, body: { ...result.body, rememberApplied: false } };
+            let rememberApplied = false;
+            try {
+                await this.withStoreDeadline(store.grant(sessionId, entry.toolName, principal ?? entry.owner), "sessionGrants.grant(deployment-list)", DURABLE_CALL_TIMEOUT_MS);
+                rememberApplied = true;
+                defaultLogger.info("approval_exemption_granted", { sessionId, toolName: entry.toolName, grantedBy: principal ?? entry.owner });
+            }
+            catch (err) {
+                defaultLogger.warn("approval_exemption_grant_failed", { sessionId, toolName: entry.toolName, error: String(err).slice(0, 200) });
+            }
+            return { ...result, body: { ...result.body, rememberApplied } };
+        })();
+    }
     precheckEditedRuleBeforeDecision(entry, parsed) {
         const persistRule = parsed.persistRule;
         if (persistRule === undefined || persistRule.kind !== "text" || !persistRule.edited)
@@ -1945,7 +2040,7 @@ export class ToolApprovalCoordinator {
                     gateBoundInputHash: row.gateBoundInputHash,
                     decision,
                     ...(parsed.note !== undefined ? { note: parsed.note } : {}),
-                    ...(parsed.settledBy !== undefined ? { settledBy: parsed.settledBy } : {}),
+                    decidedBy: parsed.decidedBy,
                     ...(parsed.updatedInput !== undefined && parsed.value !== "deny" ? { updatedInput: parsed.updatedInput } : {}),
                     ...(principal !== undefined ? { principal } : {}),
                     ...(httpReq !== undefined ? { httpReq } : {}),
@@ -2183,7 +2278,7 @@ export class ToolApprovalCoordinator {
                 decision: parsed.value === "deny" ? "deny" : "approve",
                 ...(parsed.note !== undefined ? { decisionNote: parsed.note } : {}),
                 ...(parsed.value !== "deny" && parsed.updatedInput !== undefined ? { updatedInput: parsed.updatedInput } : {}),
-                ...(parsed.settledBy !== undefined ? { settledBy: respondSettledBy(parsed) } : {}),
+                ...((sb) => (sb !== undefined ? { settledBy: sb } : {}))(liveSettledBy(parsed.decidedBy)),
             }), "decideAsk", DURABLE_CALL_TIMEOUT_MS, (late) => {
                 if (late.ok)
                     this.notifyExternalDecision(askId, outcomeOfDecidedRow(late.row));
@@ -2235,7 +2330,21 @@ export class ToolApprovalCoordinator {
     }
     finishRespond(id, entry, parsed, opts) {
         let rememberApplied;
-        const grantable = standingAnswerMayRetire(pendingEntryStandingAnswerFacts(entry));
+        const home = standingAnswerHome(pendingEntryStandingAnswerFacts(entry));
+        let grantable;
+        switch (home) {
+            case "seat":
+                grantable = true;
+                break;
+            case "none":
+            case "server_store":
+                grantable = false;
+                break;
+            default: {
+                const unhandled = home;
+                throw new Error(`unhandled standing-answer home: ${String(unhandled)}`);
+            }
+        }
         if (parsed.value === "allow_session")
             rememberApplied = Boolean(entry.sessionId) && grantable;
         if (parsed.value === "allow_session" && entry.sessionId && grantable) {
@@ -2244,10 +2353,10 @@ export class ToolApprovalCoordinator {
                 if (oldest !== undefined)
                     this.allowAllSessions.delete(oldest);
             }
-            this.allowAllSessions.add(sessionAllowKey(entry.owner, entry.sessionId, sessionAllowCategory(entry.toolName)));
+            this.allowAllSessions.add(sessionAllowKey(entry.owner, entry.sessionId, sessionAllowCategory(entry.toolName), entry.grantBinding));
         }
         const allowed = parsed.value !== "deny";
-        const settleArgs = opts?.settleOutcome !== undefined ? settleArgsOfDecided(opts.settleOutcome) : { allowed, updatedInput: parsed.updatedInput, settledBy: respondSettledBy(parsed) };
+        const settleArgs = opts?.settleOutcome !== undefined ? settleArgsOfDecided(opts.settleOutcome) : { allowed, updatedInput: parsed.updatedInput, settledBy: liveSettledBy(parsed.decidedBy) };
         const readRootGrant = opts?.settleOutcome === undefined || opts.settleOutcomeIsThisRequest === true ? parsed.readRootGrant : undefined;
         entry.settle(settleArgs.allowed, settleArgs.allowed ? "allowed" : "denied", settleArgs.updatedInput, settleArgs.settledBy, settleArgs.allowed ? undefined : parsed.note, readRootGrant);
         const updatedInputDelivered = opts?.updatedInputDelivered ?? true;
@@ -2279,7 +2388,7 @@ export class ToolApprovalCoordinator {
                 ...(e.requiresRealApproval ? { requiresRealApproval: true } : {}),
                 ...(e.governanceForced ? { governanceForced: true } : {}),
                 ...(e.mandated ? { mandated: true } : {}),
-                ...(standingAnswerMayRetire(pendingEntryStandingAnswerFacts(e)) ? {} : { rememberRefused: true }),
+                ...(standingAnswerHome(pendingEntryStandingAnswerFacts(e)) === "none" ? { rememberRefused: true } : {}),
                 ...(e.mandate !== undefined ? { mandate: e.mandate } : {}),
                 ...(e.origin !== undefined ? { origin: e.origin } : {}),
                 ...(e.originTaskId !== undefined ? { fromSubagent: true, originTaskId: e.originTaskId } : {}),

package/dist/trace/core-keyset-guard.d.ts

@@ -43,7 +43,7 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
@@ -136,7 +136,7 @@ type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTrace
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld" | "authoredBy";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
@@ -144,11 +144,11 @@ type ParkArmKeys = keyof Extract<PendingAction, {
     kind: "tool_approval";
 }>;
 type ParkArmQueueProjected = "toolName" | "toolCallId" | "boundInputHash" | "ruleOffers" | "hasBidiControls" | keyof import("../approval-card.js").ParkRowFacts;
-type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "boundGrantDigest";
+type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "allowedTools";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "allowedTools";
 type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "outputStyle";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
@@ -199,7 +199,7 @@ type WorkflowRunStripped = "sourceTaskId" | "originatingSessionId" | "effectiveA
 type _GuardWorkflowRun = AssertAllKeysHandled<Exclude<keyof WorkflowRun, WorkflowRunForwarded | WorkflowRunStripped>>;
 type _GuardWorkflowRunReverse = AssertAllKeysHandled<Exclude<WorkflowRunForwarded | WorkflowRunStripped, keyof WorkflowRun>>;
 type ParkRowKeys = keyof NonNullable<WorkflowRun["parks"]>[number];
-type ParkRowProjected = "callKey" | "sessionId" | "originRunId" | "originUnconfirmed";
+type ParkRowProjected = "callKey" | "sessionId" | "originRunId" | "originUnconfirmed" | "parkedBy" | "generation";
 type ParkRowWithheld = "token";
 type _GuardParkRow = AssertAllKeysHandled<Exclude<ParkRowKeys, ParkRowProjected | ParkRowWithheld>>;
 type _NoDoubleBookParkRow = AssertAllKeysHandled<Extract<ParkRowProjected, ParkRowWithheld>>;

package/dist/trace/redact.d.ts

@@ -50,6 +50,7 @@ import { stripFormatCharacters } from "@sema-agent/core";
  * 现役消费方:`src/tool-approval.ts` 的 `durableRuleMaterial`(规则车道素材闸)与语料的 FP=0 格。
  */
 export declare const normalizeForRedaction: typeof stripFormatCharacters;
+export declare const REDACTION_TOKEN_RE_SRC: string;
 export declare function armPoolBudgetForTest(): {
     spanCount: number;
     coveredPositions: number;
@@ -163,6 +164,11 @@ export declare function redactionSpansForTest(text: string, opts?: {
  * 让下游看到"这里有东西被省略了",而不是丢一个空对象或炸掉整条流。
  */
 export declare function redactDeep(value: unknown): unknown;
+/** {@link redactDeep} 的**串叶处置可注入**形:同一只环 / 深度守卫的遍历,只有「一个串叶怎么脱」由调用方给。
+ *  `redactDeep` 本身就是 `leaf = redactSecrets` 的那一档(行为逐字不变)。读面要的是另一档 —— 串叶走
+ *  `redactModelText`(认出凭据形才改写字节,不含凭据形的串逐字节不变),遍历不该因此再写第二份。
+ *  `leaf` 必须是纯的串→串函数且**自己不抛**(抛了就穿出本遍历)。 */
+export declare function redactDeepWith(value: unknown, leaf: (s: string) => string): unknown;
 /**
  * A REDACTED, length-BOUNDED string preview of a structured value — for surfacing a pending tool call's `args`
  * in the assistant inbox ("what is this ask about") WITHOUT leaking secrets or dumping an unbounded payload (a

package/dist/trace/redact.js

@@ -1,7 +1,7 @@
 import { displayUrlOf, stripFormatCharacters } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
 export const normalizeForRedaction = stripFormatCharacters;
-const REDACTION_TOKEN_RE_SRC = String.raw `«redacted(?::[a-z-]{1,16}){0,2}»`;
+export const REDACTION_TOKEN_RE_SRC = String.raw `«redacted(?::[a-z-]{1,16}){0,2}»`;
 const ARM_VALUE_CLASSES = [];
 const atLeast = (cls, min) => {
     ARM_VALUE_CLASSES.push(cls);
@@ -1797,11 +1797,14 @@ export function redactionSpansForTest(text, opts) {
 }
 const REDACT_MAX_DEPTH = 64;
 export function redactDeep(value) {
-    return redactDeepInner(value, 0, new WeakSet());
+    return redactDeepWith(value, redactSecrets);
 }
-function redactDeepInner(value, depth, seen) {
+export function redactDeepWith(value, leaf) {
+    return redactDeepInner(value, 0, new WeakSet(), leaf);
+}
+function redactDeepInner(value, depth, seen, leaf) {
     if (typeof value === "string")
-        return redactSecrets(value);
+        return leaf(value);
     if (!value || typeof value !== "object")
         return value;
     if (seen.has(value))
@@ -1811,11 +1814,8 @@ function redactDeepInner(value, depth, seen) {
     seen.add(value);
     try {
         if (Array.isArray(value))
-            return value.map((v) => redactDeepInner(v, depth + 1, seen));
-        const out = {};
-        for (const [k, v] of Object.entries(value))
-            out[k] = redactDeepInner(v, depth + 1, seen);
-        return out;
+            return value.map((v) => redactDeepInner(v, depth + 1, seen, leaf));
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, redactDeepInner(v, depth + 1, seen, leaf)]));
     }
     finally {
         seen.delete(value);

package/dist/trace/self-minted-wire.d.ts

@@ -19,9 +19,9 @@ export declare const SELF_MINTED_WIRE: {
         };
     };
     /**
-     * S-928(7.110.0):`engine_notice` `task.user_steer_undrained` 上**本仓铸**的那一臂。词表属主是 core(`USER_STEER_UNDRAINED_CAUSES`,
+     * S-928(7.110.0):`engine_notice` `task.user_steer_undrained` 上**本仓铸**的那一臂。词表属主是 core(`USER_INPUT_UNDRAINED_CAUSES`,两族共用;
      * `leg_end` 由引擎铸、逐字过境,不在本表);本表登记的是「这个值自哪一版起由本服务出现在 wire 上」。`satisfies Record<CrashedCause, …>`:
-     * core 删掉 `crashed` ⇒ `CrashedCause` 成 never ⇒ 本行编译红。
+     * core 删掉 `crashed` ⇒ `CrashedCause` 成 never ⇒ 本行编译红。码按受理时的车道选(`user-input-ledger.ts` `acceptedInputKindOf`,车道 = core `injectionLaneOf`,码 = core `USER_INPUT_UNDRAINED_FAMILIES`):本行 = steer 车道。
      */
     readonly userSteerUndrainedServerCause: {
         readonly at: "engine_notice task.user_steer_undrained detail.cause(本服务铸的臂;下一条同会话 run 开通告口那一拍)";
@@ -32,6 +32,16 @@ export declare const SELF_MINTED_WIRE: {
             };
         };
     };
+    /** S-1122(7.118.0,core 7.44.0 #1362):同一臂在 follow-up 车道(`later` 档)上的那一族。7.110.0–7.117.x 的这类丢失报在 steer 一族里。 */
+    readonly userFollowupUndrainedServerCause: {
+        readonly at: "engine_notice task.user_followup_undrained detail.cause(本服务铸的臂;`later` 档受理的崩溃丢失,下一条同会话 run 开通告口那一拍)";
+        readonly members: {
+            crashed: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
     /**
      * S-961(7.111.0):`wiring_manifest.instructions.selected[]` 的成员值 = 指令文件链的成员(相对 cwd 的拼写)。属主是 `project-memory.ts`
      * 的 `INSTRUCTION_FILE_CHAIN`([ref] 序:CLAUDE 族先、AGENTS 族后,首中即选)—— 链加 / 删一员 ⇒ 本行 `satisfies` 编译红,登记跟着动。
@@ -95,6 +105,10 @@ export declare const SELF_MINTED_WIRE: {
                 readonly attr: 409;
                 readonly since: "7.101.0";
             };
+            readonly "memory.scope_home_not_directory": {
+                readonly attr: 409;
+                readonly since: "7.118.0";
+            };
             readonly "memory.erasure_evidence_unavailable": {
                 readonly attr: 409;
                 readonly since: "7.108.0";

package/dist/trace/self-minted-wire.js

@@ -12,6 +12,12 @@ export const SELF_MINTED_WIRE = {
             crashed: { attr: "-", since: "7.110.0" },
         },
     },
+    userFollowupUndrainedServerCause: {
+        at: "engine_notice task.user_followup_undrained detail.cause(本服务铸的臂;`later` 档受理的崩溃丢失,下一条同会话 run 开通告口那一拍)",
+        members: {
+            crashed: { attr: "-", since: "7.118.0" },
+        },
+    },
     wiringInstructionsSelected: {
         at: "wiring_manifest instructions.selected[](本腿 loader 选中的链成员;段缺席 = 本腿无陈述)",
         members: {
@@ -34,6 +40,7 @@ export const SELF_MINTED_WIRE = {
         members: {
             "config.memory_erasure_request": { attr: 400, since: "7.52.0" },
             "memory.target_outside_store": { attr: 409, since: "7.101.0" },
+            "memory.scope_home_not_directory": { attr: 409, since: "7.118.0" },
             "memory.erasure_evidence_unavailable": { attr: 409, since: "7.108.0" },
             "memory.erasure_selector_mismatch": { attr: 409, since: "7.108.0" },
             "memory.erasure_census_incomplete": { attr: 409, since: "7.108.0" },