@sema-agent/server 7.117.0 → 7.119.0

package/dist/approval-card.d.ts

@@ -21,7 +21,7 @@
  * 没有方法、没有捕获的行为。
  */
 import { z } from "zod";
-import { ALLOW_RULE_MEMBERS, READ_ROOT_CANDIDATE_DIR_MAX, type AskClass, type AskEvidenceAbsence, type AskRequest as CoreAskRequest, type PendingAction as CorePendingAction, type ReadRootGrantCandidate, type RuleOffer } from "@sema-agent/core";
+import { ALLOW_RULE_MEMBERS, READ_ROOT_CANDIDATE_DIR_MAX, type AskClass, type AskEvidenceAbsence, type AskRequest as CoreAskRequest, type PendingAction as CorePendingAction, type ReadRootGrantCandidate, type RuleOffer, type SteerReplayFacet } from "@sema-agent/core";
 import type { AskRow } from "./plugins/approval-ask-store-sql.js";
 /** 模型自由文本(`sourceAgentName` / `delegation.agentName`)的限长(设计稿 §6.2)。设计 §3.1 把
  *  「限长 + 脱敏」写成 **server 新增责任**(引擎无此层):spawning model 挑的名字是自由文本,
@@ -81,11 +81,13 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
     kind: z.ZodLiteral<"single">;
     rule: z.ZodString;
     match: z.ZodEnum<{
+        name: "name";
         path: "path";
         exact: "exact";
         prefix: "prefix";
         wildcard: "wildcard";
         subpath: "subpath";
+        name_prefix: "name_prefix";
     }>;
     command: z.ZodString;
 }, z.core.$strict>, z.ZodObject<{
@@ -94,11 +96,13 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
         kind: z.ZodLiteral<"command">;
         rule: z.ZodString;
         match: z.ZodEnum<{
+            name: "name";
             path: "path";
             exact: "exact";
             prefix: "prefix";
             wildcard: "wildcard";
             subpath: "subpath";
+            name_prefix: "name_prefix";
         }>;
         command: z.ZodString;
         segment: z.ZodString;
@@ -158,11 +162,13 @@ export declare const RuleOfferRawSchema: z.ZodUnion<readonly [z.ZodObject<{
     kind: z.ZodLiteral<"single">;
     rule: z.ZodString;
     match: z.ZodEnum<{
+        name: "name";
         path: "path";
         exact: "exact";
         prefix: "prefix";
         wildcard: "wildcard";
         subpath: "subpath";
+        name_prefix: "name_prefix";
     }>;
     command: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
@@ -171,11 +177,13 @@ export declare const RuleOfferRawSchema: z.ZodUnion<readonly [z.ZodObject<{
         kind: z.ZodLiteral<"command">;
         rule: z.ZodString;
         match: z.ZodEnum<{
+            name: "name";
             path: "path";
             exact: "exact";
             prefix: "prefix";
             wildcard: "wildcard";
             subpath: "subpath";
+            name_prefix: "name_prefix";
         }>;
         command: z.ZodString;
         segment: z.ZodString;
@@ -437,7 +445,7 @@ type ToolApprovalPark = Extract<CorePendingAction, {
     kind: "tool_approval";
 }>;
 /**
- * 🔴 **闭集词座的唯一窄读**(S-721 起 `mandate`;S-755 起 `origin`)—— 一座一只 core 成员筛,**名字是参数**(与
+ * 🔴 **闭集词座的唯一窄读**(S-721 起 `mandate`;S-755 起 `origin`;S-1170 起 `classifierNoRuling` / `differs`)—— 一座一只成员筛,**名字是参数**(与
  * {@link readParkRowTrueSeat} 同一条:一处解析,不是两只各写一遍的函数)。
  *  · `mandate`(core 7.32.0 #1092)—— 一问**站在哪一个 mandate 词上**(`mandated` 说「站在强制上」,本座说是 core
  *    `PERSISTED_RULE_MANDATES` 六词里的哪一个;core 只在强制位的**整因**是那一个词时铸 —— 治理 / hook / 祖先,或不止一个理由
@@ -446,6 +454,11 @@ type ToolApprovalPark = Extract<CorePendingAction, {
  *  · `origin`(core 7.5.0 [ref] 的 park 孪生座;S-755)—— **谁提的这一问**,core `ASK_ORIGINS` 闭集一词。读者:运维队列行读寄存行
  *    孪生座 `PendingAction.tool_approval.origin`({@link parkRowFacts})。活卡帧**不经**本函数:它读引擎在门上刚盖好的
  *    `AskRequest.origin`(盖章点即 core 的筛点),照旧只过「非空串」形门(`tool-approval.ts` 帧键 `origin` 顶注)。
+ *  · `classifierNoRuling`(core 7.43.0 #1353)—— 分类器没给判词的成因词,core `AUTO_MODE_FALLBACK_CAUSES` 闭集一词(筛 = `isAutoModeFallbackCause`)。
+ *    读者:活卡帧读 `AskRequest.classifierNoRuling`(`tool-approval.ts`);inbox 行读 core `CheckpointSummary` 已筛过的同名位、直投不经本函数。
+ *  · `differs`(core 7.44.0 #1374)—— **载体是引擎拒 steer 重放那只错的 `detail`**(不是 ask 的三个载体之一),值是 core `STEER_REPLAY_FACETS` 的**非空子集**
+ *    (core:「恒非空」;筛 = 本文件 {@link isSteerReplayDiffers},成员表取 core 常量)。读者:`runs.ts` 的 409 `steering.duplicate_input_id` 体(`detail.differs`)。
+ *    集外成员 / 空数组 / 非数组 ⇒ 按缺席(不铸 `detail`,码仍是契约)+ 计一次;detail 只报形名(`differs=<array>` —— 数组从不展开成员,见 {@link outOfSetDetail})。
  *
  * 什么时候经本函数 —— 一句话:**筛点在 core;server 只在「读的是持久层原字节、中间没有 core 投影」的地方亲手调 core 的那一只筛**。
  * inbox 行读 core `CheckpointSummary.{mandate,origin}`(core `summarizeCheckpoint` 已用同一只 `isPersistedRuleMandate` / `isAskOrigin`
@@ -459,10 +472,12 @@ type ToolApprovalPark = Extract<CorePendingAction, {
  * 只读值不调用值)。
  */
 export declare function readClosedWordSeat<S extends ClosedWordSeat>(carrier: object, seat: S): ClosedWordOf<S> | undefined;
-/** 闭集词座的名:三个 core 载体上**同名**(`AskRequest` / 寄存行 `tool_approval` 臂 / `CheckpointSummary`)—— 任一处改名 / 退役 ⇒ 下面的围栏编译红。 */
-type ClosedWordSeat = "mandate" | "origin";
-/** 一座的值型 = core 寄存行上那一座的型(去掉可选位的 `undefined`)。 */
-type ClosedWordOf<S extends ClosedWordSeat> = NonNullable<ToolApprovalPark[S]>;
+/** ask 载体上的闭集词座名:三个 core 载体上**同名**(`AskRequest` / 寄存行 `tool_approval` 臂 / `CheckpointSummary`)—— 任一处改名 / 退役 ⇒ 下面的围栏编译红。 */
+type AskClosedWordSeat = "mandate" | "origin" | "classifierNoRuling";
+/** 闭集词座的名 = ask 载体上的三座 + 引擎拒 steer 重放那只错的 `detail.differs`(载体不同、读法同一只)。 */
+type ClosedWordSeat = AskClosedWordSeat | "differs";
+/** 一座的值型:ask 三座 = core 寄存行上那一座的型(去掉可选位的 `undefined`);`differs` = core 闭集 `SteerReplayFacet` 的数组(core `detail.differs` 的型)。 */
+type ClosedWordOf<S extends ClosedWordSeat> = S extends AskClosedWordSeat ? NonNullable<ToolApprovalPark[S]> : readonly SteerReplayFacet[];
 /**
  * 🔴 **S-934 ②(core 7.37.0 #1214)—— ask 类对的唯一窄读**:`askClass`(一问的类 = `classes` 的首员)与 `classes`(这一问属于的全部类,core
  * `ASK_CLASSES` 序)。三个载体上同名:`AskRequest`(活卡帧 / 呈卡帧的卡读它)、寄存行 `PendingAction.tool_approval`(运维队列行经
@@ -600,11 +615,13 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         kind: z.ZodLiteral<"single">;
         rule: z.ZodString;
         match: z.ZodEnum<{
+            name: "name";
             path: "path";
             exact: "exact";
             prefix: "prefix";
             wildcard: "wildcard";
             subpath: "subpath";
+            name_prefix: "name_prefix";
         }>;
         command: z.ZodString;
     }, z.core.$strict>, z.ZodObject<{
@@ -613,11 +630,13 @@ export declare const ApprovalCardSchema: z.ZodObject<{
             kind: z.ZodLiteral<"command">;
             rule: z.ZodString;
             match: z.ZodEnum<{
+                name: "name";
                 path: "path";
                 exact: "exact";
                 prefix: "prefix";
                 wildcard: "wildcard";
                 subpath: "subpath";
+                name_prefix: "name_prefix";
             }>;
             command: z.ZodString;
             segment: z.ZodString;
@@ -676,8 +695,8 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }, z.core.$strict>>>;
         personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
     }, z.core.$strict>>;
-    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
     fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
     sourceTaskId: z.ZodOptional<z.ZodString>;
     sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -726,11 +745,13 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             kind: z.ZodLiteral<"single">;
             rule: z.ZodString;
             match: z.ZodEnum<{
+                name: "name";
                 path: "path";
                 exact: "exact";
                 prefix: "prefix";
                 wildcard: "wildcard";
                 subpath: "subpath";
+                name_prefix: "name_prefix";
             }>;
             command: z.ZodString;
         }, z.core.$strict>, z.ZodObject<{
@@ -739,11 +760,13 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
                 kind: z.ZodLiteral<"command">;
                 rule: z.ZodString;
                 match: z.ZodEnum<{
+                    name: "name";
                     path: "path";
                     exact: "exact";
                     prefix: "prefix";
                     wildcard: "wildcard";
                     subpath: "subpath";
+                    name_prefix: "name_prefix";
                 }>;
                 command: z.ZodString;
                 segment: z.ZodString;
@@ -802,8 +825,8 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }, z.core.$strict>>>;
             personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
         }, z.core.$strict>>;
-        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
         fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
         sourceTaskId: z.ZodOptional<z.ZodString>;
         sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -976,6 +999,13 @@ export declare function buildRevokeFrame(batchId: string, askIds: readonly strin
  *    竞争者;收敛是车2 的窗到期竞争者与车5 恢复扫描的职责)。
  */
 export declare function buildReplayFrame(row: AskRow, nowMs: number): ApprovalRequestFrame | undefined;
+/**
+ * S-1154 —— 持久行上那张卡**要不要人**:卡面 `risk.requiresRealApproval`(铸卡时取自引擎在 `AskRequest` 上盖的同一位,
+ * {@link buildApprovalCard} 第三参)。读者 = 耐久 ask 回决口在裁决之前交给引擎判官 `policyCannotAnswer` 的那一问(`host-decision.ts` 的 `heldAskOf`)。
+ * 🔴 读不出卡(`card_json` 形不合)⇒ **按要人读**(fail-closed):这一位只用来**拒**策略的放行,读坏的行上拒一次可以改成人答 / 策略拒
+ * 再来;反方向(读坏当不要人)会让一次引擎终将拒掉的放行先落成一条宣称 approve 的行。
+ */
+export declare function storedCardDemandsAPerson(cardJson: unknown): boolean;
 /** {@link buildApprovalPreamble} 的返回形——帧 + 两个**计数**(调用方按自己的 logger 记 warn;本模块
  *  保持纯函数,不吃 logger:那会让一个 `build*` 捕获行为)。 */
 export interface ApprovalPreamble {

package/dist/approval-card.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, isAskClass, isAskOrigin, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
+import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, STEER_REPLAY_FACETS, isAskClass, isAskOrigin, isAutoModeFallbackCause, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
 import { redactSecrets } from "./trace/redact.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { PERSISTED_RULE_MATCHES, UNCOVERED_SEGMENT_REASONS } from "./permission-rule-vocab.js";
@@ -314,9 +314,15 @@ export function readClosedWordSeat(carrier, seat) {
     recordFailOpen("server.approval-card.closed-word-out-of-set", `${seat}=${outOfSetDetail(raw)}`);
     return undefined;
 }
+function isSteerReplayDiffers(v) {
+    const facets = STEER_REPLAY_FACETS;
+    return Array.isArray(v) && v.length > 0 && v.every((f) => facets.includes(f));
+}
 const CLOSED_WORD_SEAT_GUARDS = {
     mandate: isPersistedRuleMandate,
     origin: isAskOrigin,
+    classifierNoRuling: isAutoModeFallbackCause,
+    differs: isSteerReplayDiffers,
 };
 export function readAskClassPair(carrier) {
     const askClass = "askClass" in carrier ? carrier.askClass : undefined;
@@ -520,6 +526,10 @@ export function buildReplayFrame(row, nowMs) {
         approvalId: parsed.data.approvalId,
     };
 }
+export function storedCardDemandsAPerson(cardJson) {
+    const parsed = ApprovalCardEnvelopeSchema.safeParse(cardJson);
+    return !parsed.success || parsed.data.card.risk.requiresRealApproval;
+}
 export function buildApprovalPreamble(rows, nowMs, replayMax) {
     const frames = [];
     let skipped = 0;

package/dist/approval.d.ts

@@ -3,9 +3,10 @@
  * (createOaApprovalPolicy + ApprovalStore pending 行轮询)整体退役;唯一门形 = durable checkpoint
  * suspend/resume,见 createDurableAskPolicy 与 /v1/approvals 的 checkpointStore 腿)。
  */
-import { type ToolPolicy } from "@sema-agent/core";
+import { type ToolCallRequest, type ToolPolicy } from "@sema-agent/core";
 import { type PostureSource } from "./posture-source.js";
 import { type ExecutionLane } from "./execution-lane-caps.js";
+import { type ApprovalExemptionStore } from "./plugins/approval-exemption-store.js";
 /**
  * 门意图判据读的五个量(`ServiceConfig` 结构满足)。单独成型是为了让**热路径**能拿「候选视图」来判
  * (S-668 波 2:`{ ...config, approvalRequire: 候选名单 }`)—— 判据只有一份,输入可以是活配置也可以是候选。
@@ -52,7 +53,7 @@ export declare function singleUserAutoAcceptBaselineApplies(config: GateIntentVi
     readonly requirePrincipal: boolean;
 }): boolean;
 /**
- * 门意图**不可服务**的判据 —— 返回拒因(可服务 ⇒ `undefined`)。**全仓唯一一份**,两处调用、处置不同:
+ * 门意图**不可服务**的判据 —— 返回拒因(可服务 ⇒ `undefined`)。**全仓唯一一份**,三处调用、处置不同:
  *  · **boot**(`boot/stage-07-capability-layer.ts`):对装配完的整份 config 判,拒因 ⇒ **拒启**(全窗复审 D3-F1,
  *    HIGH;与 env 墓碑族同谱系)。v4.3.0 的轮询门形(APPROVAL_REQUIRE + DB backend + DURABLE_APPROVAL 未设)在
  *    5.0.0 只剩 core 每任务 warn——**原先拦、现在放**(方向反转)。「留 undefined 让 core warn」对新配置是
@@ -60,6 +61,9 @@ export declare function singleUserAutoAcceptBaselineApplies(config: GateIntentVi
  *  · **热路径**(S-668 波 2 ④,`config-center/apply-effective.ts` 的审批组 stage):对**候选视图**
  *    (活配置 + 候选名单)判,拒因 ⇒ 审批组**整组拒**、活配置零变化、世代账停旧代。进程在跑,拒启不是选项;
  *    而放行一份「没有 checkpoint 店可停车」的名单 = 单用户 auto-accept 基线仍在、名单静默不生效。
+ *  · **每个任务的装配**(S-1144,`boot/resolve-spec.ts` 的 `resolveSpec` 头一道):对**活配置**判,拒因 ⇒ 请求 501
+ *    `capability.checkpoint_store_required`。部署形到不了(boot 已拒启);可达的是嵌入方装配 / 直调 `resolveSpec`(自己递 ctx、没经 stage-07)。
+ *    修前这一形把审批基线静默铸成 `undefined`,请求的 allow 清「普通问」后任务零卡落盘 —— 同一条规则在起服层拒、在装配层静默 = 一事两读。
  * `checkpointStorePresent` 是**部署事实**(本进程建没建出 checkpoint 店),不在 `ServiceConfig` 里 ⇒ 调用方显式递。
  * 放这文件与 hasOperatorGateIntent/inv#2 同源(意图判据再漂要同时改两段)。
  */
@@ -129,22 +133,56 @@ export declare function buildForceDurableGateInertNotice(input: {
  * replica. (The former poll-lane
  * twin, createOaApprovalPolicy, was retired in 5.0.0 — durable is the only gate.)
  */
-export interface DurableAskOptions {
-    requireApproval: string[];
-    deny?: string[];
+export interface DurableAskOptions extends ApprovalListsView {
     autoBudget?: number;
-    neverAuto?: string[];
-    /** Per-session approval-exemption probe ("本会话不再询问"): consulted ONLY for require-listed
-     *  tools, AFTER deny/neverAuto (both always win) and BEFORE the budget path. Canonical-space toolName.
-     *  A rejected promise is treated as NOT exempt (fail-closed → ask) at the call site below.
-     *  🔴 S-877 候裁 16:会话授权**两个读位、一只店、按问句的作者分**(收车档 ⑩ 16):本探针兑现**本仓自己的问**(名单门)
-     *  —— 在它自己的层上「不问」,于是委派子代经父约束链继承到的同一问也不问;引擎自装的问(模式写门 / 形状层)由审批席
-     *  (`ToolApprovalCoordinator.standingGrantSettles`)兑现。本探针**不能**退役:子代的继承问到达祖先审批席时 core 盖
-     *  `mandated`(`ruleClearanceOf` 的 inheritedUnresolved / ancestorResolved 门),席的判据依约不退役它 —— 只有本层的
-     *  「不问」够得着继承链(钉 test/parked-decide-leg.test.ts「[候裁② 修]remember 全链行为」)。 */
-    exempt?: (canonicalToolName: string) => Promise<boolean>;
-    /** Audit hook — fired when an exemption short-circuits the ask (the `approval_exempted` log line). */
-    onExempted?: (canonicalToolName: string, rawToolName: string) => void;
+    /** 本会话的「本会话放行」读面(server 的会话豁免店,键 = 会话 × wire 工具名)。缺席 = 这条腿没有会话 / 没有店 ⇒ 名单门照问。 */
+    exemption?: DeploymentListExemption;
 }
+/** 三张运维名单(一只调用由哪一张说话)的入参 —— 名单门与「问的属主」读法同读这一份。 */
+export interface ApprovalListsView {
+    readonly requireApproval: readonly string[];
+    readonly deny?: readonly string[];
+    readonly neverAuto?: readonly string[];
+}
+/**
+ * 三张运维名单对**一只调用**的判词(deny 先于 never-auto 先于 require),`hit` = 命中的那个名(规则归因写运维名单里的那个)。
+ * 名单门按它出 deny / 恒问人 / 名单的问;「这张卡上有没有名单自己的问」也按它读(见 {@link deploymentListAsks})—— 一份读法,两个读者。
+ */
+export type ApprovalListVerdict = {
+    readonly list: "deny";
+} | {
+    readonly list: "never_auto" | "require";
+    readonly hit: string;
+} | {
+    readonly list: "none";
+};
+/** 铸一只判词函数(名单的命中集与 covering 规则只解一次)。名字读法 = {@link heldRuleName}(收紧臂读调用答得上的全部名字)。 */
+export declare function createApprovalListVerdict(lists: ApprovalListsView): (call: Pick<ToolCallRequest, "toolName" | "face">) => ApprovalListVerdict;
+/**
+ * **「问的属主」的读法**:部署名单门对这只调用出不出它**自己的**那一问(`APPROVAL_REQUIRE` 臂)—— 读的是铸点本身(同一只判词),
+ * 不另造一张表。读者:审批席(活卡的提示位 / 回决写侧)、耐久 `/decide` 腿与运维队列行(停驻行上只有工具名,按 wire 名读)。
+ * 名单是热换的(中心下发),读者每次现读活配置。答 `true` 只说「名单门问这只调用」;这张卡是不是名单的那一问,还要看卡上的类
+ * (`tool-approval.ts` 的 `StandingAnswerFacts.deploymentListQuestion`)。
+ */
+export declare function deploymentListAsks(config: Pick<GateIntentView, "approvalRequire" | "approvalDeny" | "approvalNeverAuto">, call: Pick<ToolCallRequest, "toolName" | "face">): boolean;
+/**
+ * 名单门的「本会话放行」读面:本会话的豁免店读一次 + server 自己的审计行。名单的问是 server 铸的,它的站着的答案记在 server 的
+ * 会话豁免店(活卡的 `allow_session` 与耐久 `/decide` 的 `remember:"session"` 写同一只店),名单门在出问**之前**读它。
+ */
+export interface DeploymentListExemption {
+    /** 这只工具(wire 名)在本会话有没有豁免行。有界、fail-closed:读抛 / 超时 ⇒ `false`(照问,人多看一张卡)。 */
+    readonly has: (toolName: string) => Promise<boolean>;
+    /** 名单门因为豁免行没出问 —— server 自己的审计行(宿主豁免;不是人答的、不是策略代答的、没有记住任何东西)。 */
+    readonly onExempted: (toolName: string) => void;
+}
+/**
+ * 名单门豁免读面的**唯一**铸点(HTTP 腿 `resolve-spec` 与 park 赎回腿 `parked-revive-gate` 两处装配都经它):键 = 会话 × wire 工具名
+ * (与活卡 `allow_session` / `/decide` remember 写下的键同形)。审计事件名 {@link APPROVAL_EXEMPTED_EVENT},字段只有会话、工具与读位
+ * `seat: "deployment_list"`(审批席自己那一行是 `seat: "approval_seat"`)。读的期限与审批席读同一只店的期限同值。
+ */
+export declare function createDeploymentListExemption(store: Pick<ApprovalExemptionStore, "has">, sessionId: string, logger: {
+    info(event: string, fields?: Record<string, unknown>): void;
+    warn(event: string, fields?: Record<string, unknown>): void;
+}, leg?: "parked_revive"): DeploymentListExemption;
 export declare function createDurableAskPolicy(opts: DurableAskOptions): ToolPolicy;
 //# sourceMappingURL=approval.d.ts.map

package/dist/approval.js

@@ -4,7 +4,8 @@ import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 import { isExplicitPosture } from "./posture-source.js";
 import { handsOnWorkerFilePlane } from "./execution-lane-caps.js";
 import { heldRuleName } from "./tool-rule-names.js";
-import { answerGrantsBeyondCall } from "./standing-answer-grant.js";
+import { DURABLE_CONVERGE_READ_TIMEOUT_MS, policyAskStandingAnswerFacts, standingAnswerDurablyRecordable } from "./tool-approval.js";
+import { APPROVAL_EXEMPTED_EVENT } from "./plugins/approval-exemption-store.js";
 export function hasApprovalListIntent(config) {
     return (config.approvalRequire.length > 0 ||
         config.approvalDeny.length > 0 ||
@@ -68,6 +69,49 @@ export function buildForceDurableGateInertNotice(input) {
         },
     };
 }
+export function createApprovalListVerdict(lists) {
+    const require = createNameSetMatcher(lists.requireApproval);
+    const deny = createNameSetMatcher(lists.deny ?? []);
+    const neverAuto = createNameSetMatcher(lists.neverAuto ?? []);
+    return (call) => {
+        if (heldRuleName(call, deny) !== undefined)
+            return { list: "deny" };
+        const neverAutoHit = heldRuleName(call, neverAuto);
+        if (neverAutoHit !== undefined)
+            return { list: "never_auto", hit: neverAutoHit };
+        const requireHit = heldRuleName(call, require);
+        if (requireHit !== undefined)
+            return { list: "require", hit: requireHit };
+        return { list: "none" };
+    };
+}
+export function deploymentListAsks(config, call) {
+    return createApprovalListVerdict({ requireApproval: config.approvalRequire, deny: config.approvalDeny, neverAuto: config.approvalNeverAuto })(call).list === "require";
+}
+export function createDeploymentListExemption(store, sessionId, logger, leg) {
+    const where = { sessionId, ...(leg !== undefined ? { leg } : {}) };
+    return {
+        has: async (toolName) => {
+            let timer;
+            try {
+                const deadline = new Promise((_, reject) => {
+                    timer = setTimeout(() => reject(new Error(`exemption read timed out after ${DURABLE_CONVERGE_READ_TIMEOUT_MS}ms`)), DURABLE_CONVERGE_READ_TIMEOUT_MS);
+                    timer.unref?.();
+                });
+                return (await Promise.race([store.has(sessionId, toolName), deadline])) === true;
+            }
+            catch (err) {
+                logger.warn("session_grant_read_failed", { ...where, toolName, seat: "deployment_list", error: String(err).slice(0, 200) });
+                return false;
+            }
+            finally {
+                if (timer !== undefined)
+                    clearTimeout(timer);
+            }
+        },
+        onExempted: (toolName) => logger.info(APPROVAL_EXEMPTED_EVENT, { ...where, toolName, seat: "deployment_list" }),
+    };
+}
 function createNameSetMatcher(names) {
     const exact = new Set(names);
     const covering = names.filter(isNamespacedCoveringRuleName);
@@ -79,44 +123,27 @@ function grantedByRule() {
     return { action: "allow", decisionReason: "rule" };
 }
 export function createDurableAskPolicy(opts) {
-    const require = createNameSetMatcher(opts.requireApproval);
-    const deny = createNameSetMatcher(opts.deny ?? []);
-    const neverAuto = createNameSetMatcher(opts.neverAuto ?? []);
+    const verdictOf = createApprovalListVerdict(opts);
     const budget = Math.max(0, Math.floor(opts.autoBudget ?? 0));
     let autoApproved = 0;
     const isQuestionTool = (name) => name === ASK_USER_QUESTION_TOOL_NAME;
     return {
         check: (req) => {
-            if (heldRuleName(req, deny) !== undefined)
-                return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
-            const neverAutoHit = heldRuleName(req, neverAuto);
-            if (neverAutoHit !== undefined)
-                return operatorAlwaysHumanAsk(`APPROVAL_NEVER_AUTO(${neverAutoHit})`, `human approval required to run "${req.toolName}"`);
-            const requireHit = heldRuleName(req, require);
-            if (requireHit !== undefined) {
-                const remEarly = req.budget?.resourceRemainingMicroUsd;
-                if (remEarly !== undefined && remEarly <= 0) {
-                    return operatorAlwaysHumanAsk("RESOURCE_SUSPEND budget exhausted", `durable resource budget exhausted — human approval required to run "${req.toolName}"`);
-                }
-                if (opts.exempt && heldRuleName(req, isQuestionTool) === undefined && !answerGrantsBeyondCall(req)) {
-                    return (async () => {
-                        let exempted = false;
-                        try {
-                            exempted = (await opts.exempt(req.toolName)) === true;
-                        }
-                        catch {
-                            exempted = false;
-                        }
-                        if (exempted) {
-                            opts.onExempted?.(req.toolName, req.toolName);
-                            return grantedByRule();
-                        }
-                        return decideRequired(req, requireHit);
-                    })();
+            const verdict = verdictOf(req);
+            switch (verdict.list) {
+                case "deny":
+                    return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
+                case "never_auto":
+                    return operatorAlwaysHumanAsk(`APPROVAL_NEVER_AUTO(${verdict.hit})`, `human approval required to run "${req.toolName}"`);
+                case "require":
+                    return decideRequired(req, verdict.hit);
+                case "none":
+                    return { action: "allow" };
+                default: {
+                    const unreachable = verdict;
+                    throw new Error(`unhandled approval-list verdict: ${JSON.stringify(unreachable)}`);
                 }
-                return decideRequired(req, requireHit);
             }
-            return { action: "allow" };
         },
     };
     function decideRequired(req, requireHit) {
@@ -124,11 +151,25 @@ export function createDurableAskPolicy(opts) {
         if (rem !== undefined && rem <= 0) {
             return operatorAlwaysHumanAsk("RESOURCE_SUSPEND budget exhausted", `durable resource budget exhausted — human approval required to run "${req.toolName}"`);
         }
+        const ask = operatorAsk(`APPROVAL_REQUIRE(${requireHit})`, `approval required to run "${req.toolName}"`);
+        if (opts.exemption !== undefined && standingAnswerDurablyRecordable(policyAskStandingAnswerFacts(req, ask, true))) {
+            const exemption = opts.exemption;
+            return (async () => {
+                if (await exemption.has(req.toolName)) {
+                    exemption.onExempted(req.toolName);
+                    return { action: "allow" };
+                }
+                return budgetOrAsk(req, ask);
+            })();
+        }
+        return budgetOrAsk(req, ask);
+    }
+    function budgetOrAsk(req, ask) {
         if (heldRuleName(req, isQuestionTool) === undefined && budget > 0 && autoApproved < budget) {
             autoApproved++;
             return grantedByRule();
         }
-        return operatorAsk(`APPROVAL_REQUIRE(${requireHit})`, `approval required to run "${req.toolName}"`);
+        return ask;
     }
 }
 //# sourceMappingURL=approval.js.map

package/dist/audit.d.ts

@@ -16,7 +16,9 @@ export interface SessionAudit {
         provider: string;
         modelId: string;
     } | null;
-    /** Current model context: prior messages with older history collapsed into a summary message. */
+    /** Current model context: prior messages with older history collapsed into a summary message.
+     *  🔴 **存档原形**(store 里怎么写就怎么回)—— 不是 wire 形。HTTP 读面一律过 {@link redactSessionViewForRead}(次序 = 选窗 → 脱敏 → 截断)
+     *  再回给调用方;直接消费本视图的宿主(`buildSessionAudit` 是包根导出)自己负责同一道脱敏。 */
     messages: unknown[];
     /** [ref]① web 观测切片 B: the session's prompt-epoch pin, core contract verbatim (core 1.304
      *  `session.getPromptEpoch()` — first-class `prompt_epoch` entry, compaction restatement, [ref] anchor
@@ -36,10 +38,19 @@ export declare function buildSessionAudit(pool: Pool, sessionId: string): Promis
  *  (its storage seam has no wake-equivalent yet — may turn out to be a core gap). */
 export declare function buildSessionAuditPg(pool: PgPool, sessionId: string): Promise<SessionAudit | undefined>;
 /** The LOCAL (File) leg — web session area on DB_BACKEND=local.
+ *  repo 取自 `createLocalSessionRepo`(与 `LocalSessionStore` 同一只工厂):坏记录的披露座(F 类 `server.session-repo.corrupt-record-skipped`)
+ *  因此在视图口同样在场 —— 视图照常返回、跳过的记录有计数 + 探针行(修前自建一只不带座的 repo,零披露)。
  *  实现姿势:`FileSessionRepo.exportEntries`(纯读、torn-tail 恢复、missing→not_found)→
  *  `boundedTail`(纯函数切 floor)→ InMemorySessionStorage → 同一 auditFromStorage 内核。零写面、
  *  零新 seam;createdAt 从 repo.list() 的 metadata 取(File 形态 meta 与 entries 分储)。 */
 export declare function buildSessionAuditLocal(root: string, sessionId: string): Promise<SessionAudit | undefined>;
+/**
+ * 🔴 **会话视图的读面口 —— `GET /v1/sessions/:id` 的全部取法(整读 / `?tail` / `?before` / `?blobCap` / `?message=N`)共用这一只**。
+ * 次序 = **选 → 脱 → 截**(路由 `http/routes/sessions.ts`):整条消息的选窗不切字符串,先选窗不改任何一条的脱敏读数、只把脱敏的量降到选中的那几条;
+ * `blobCap` 的截断会切字符串(预览切在密钥中间,半截密钥认不出来)⇒ 截断恒在脱敏之后。
+ * `messages` 缺席 ⇒ 不铸键;非数组 ⇒ 深扫;其余键(`owner` / `promptEpoch` / `model` …)逐字。字节没变 ⇒ **同一引用**。
+ */
+export declare function redactSessionViewForRead<V extends object>(view: V): V;
 /** Window `messages` — `tail=N` (last N) or `before=<offset>&limit=N` ([max(0,before-N), before)).
  *  Returns the window + its {offset,total} so the web can page upward. */
 export declare function windowMessages(messages: unknown[], opts: {

package/dist/audit.js

@@ -1,6 +1,9 @@
-import { StoredSession, FileSessionRepo, InMemorySessionStorage, boundedTail } from "@sema-agent/core";
+import { StoredSession, InMemorySessionStorage, boundedTail } from "@sema-agent/core";
 import { TiDBSessionStorage } from "./plugins/tidb-session-storage.js";
 import { PgSessionStorage } from "./plugins/pg-session-storage.js";
+import { createLocalSessionRepo } from "./plugins/local-session-store.js";
+import { redactModelText } from "./observability/run-terminal.js";
+import { redactDeepWith } from "./trace/redact.js";
 export async function buildSessionAudit(pool, sessionId) {
     return auditFromStorage(await TiDBSessionStorage.wake(pool, sessionId), sessionId);
 }
@@ -8,7 +11,7 @@ export async function buildSessionAuditPg(pool, sessionId) {
     return auditFromStorage(await PgSessionStorage.wake(pool, sessionId), sessionId);
 }
 export async function buildSessionAuditLocal(root, sessionId) {
-    const repo = new FileSessionRepo(root);
+    const repo = createLocalSessionRepo(root);
     let entries;
     try {
         entries = await repo.exportEntries(sessionId);
@@ -40,6 +43,63 @@ async function auditFromStorage(storage, sessionId) {
         ...(promptEpoch ? { promptEpoch } : {}),
     };
 }
+const deepScrub = (v) => redactDeepWith(v, redactModelText);
+const textSlot = (v) => (typeof v === "string" ? redactModelText(v) : deepScrub(v));
+function scrubSlot(p, key, scan) {
+    const v = p[key];
+    if (v === undefined)
+        return p;
+    const next = scan(v);
+    return next === v ? p : { ...p, [key]: next };
+}
+const PART_READ_TREATMENT = {
+    text: (p) => scrubSlot(p, "text", textSlot),
+    thinking: (p) => scrubSlot(p, "thinking", textSlot),
+    toolCall: (p) => scrubSlot(p, "arguments", deepScrub),
+    image: (p) => p,
+    document: (p) => p,
+};
+function readParts(content) {
+    if (!Array.isArray(content))
+        return textSlot(content);
+    const next = content.map((part) => {
+        if (part !== null && typeof part === "object" && !Array.isArray(part)) {
+            const type = part.type;
+            if (typeof type === "string" && Object.hasOwn(PART_READ_TREATMENT, type)) {
+                return PART_READ_TREATMENT[type](part);
+            }
+        }
+        return deepScrub(part);
+    });
+    return next.every((x, i) => x === content[i]) ? content : next;
+}
+const readContent = (m) => scrubSlot(m, "content", readParts);
+const MESSAGE_READ_TREATMENT = {
+    user: (m) => m,
+    custom: (m) => m,
+    assistant: (m) => readContent(m),
+    toolResult: (m) => scrubSlot(readContent(m), "details", deepScrub),
+    bashExecution: (m) => scrubSlot(scrubSlot(m, "command", textSlot), "output", textSlot),
+    compactionSummary: (m) => scrubSlot(m, "summary", textSlot),
+};
+function readMessage(m) {
+    if (m !== null && typeof m === "object" && !Array.isArray(m)) {
+        const role = m.role;
+        if (typeof role === "string" && Object.hasOwn(MESSAGE_READ_TREATMENT, role)) {
+            return MESSAGE_READ_TREATMENT[role](m);
+        }
+    }
+    return deepScrub(m);
+}
+export function redactSessionViewForRead(view) {
+    const { messages } = view;
+    if (messages === undefined)
+        return view;
+    const next = Array.isArray(messages)
+        ? (() => { const out = messages.map(readMessage); return out.every((x, i) => x === messages[i]) ? messages : out; })()
+        : deepScrub(messages);
+    return next === messages ? view : { ...view, messages: next };
+}
 export function windowMessages(messages, opts) {
     const total = messages.length;
     if (opts.before !== undefined) {

package/dist/auto-mode-face.d.ts

@@ -42,8 +42,7 @@
  * `entitlementSource`(既有位)说的是「center 源在不在」;`armed` 说的是「按三态谓词此刻会不会武装」。
  * 两者刻意并存:前者告诉壳有没有组织面,后者告诉壳这台机器上 auto 到底是不是 default 的别名。
  */
-import { type RunnerDeps, type RuntimeCaps } from "@sema-agent/core";
-import type { SettingsPermissionMode } from "./task-settings.js";
+import { type PermissionMode, type RunnerDeps, type RuntimeCaps } from "@sema-agent/core";
 /**
  * 分类器席的模型 —— **调 core 的单一解析器** `classifierSeatModel({deps, main})`(core 7.20.0 / [ref],
  * 本仓 [ref] 的跨仓诉求兑现;契约句 `classifier.seat.one_resolver` 逐字:引擎的武装点与**显示这个席**
@@ -123,7 +122,7 @@ export type AutoModeVerdict = {
  * 走到这里还在抛 = 装配缺陷,读面 500 比一句编出来的 reason 诚实。
  */
 export declare function judgeAutoModeArming(face: AutoModeFaceDeps | undefined, input: {
-    readonly requestedMode: SettingsPermissionMode | undefined;
+    readonly requestedMode: PermissionMode | undefined;
     readonly principal: string | undefined;
     /** 本地 `PERMISSIONS_DISABLE_AUTO_MODE`(= catalog/settings 键 `permissions.disableAutoMode`)是否置 true —— caps false 时分词
      *  `local_denied` / `org_denied`(seam ⑤;两者对壳的指路不同:改本机 env vs 找组织)。 */