@sema-agent/server 7.117.0 → 7.119.0

package/dist/host-decision.d.ts

@@ -1,6 +1,7 @@
 /**
  * **宿主的决策事实** —— 一条耐久 park 被结算时,本服务能如实陈述的那半件事:谁结束了这次等待,以及
- * 审批通道自报的归属。一个叶子模块(只依赖 `@sema-agent/core`),四个消费点共用一个定义。
+ * 审批通道自报的归属,以及决定体上陈述「谁决定的」那一只键(`decidedBy`)的闭集、读法与映射。一个叶子模块
+ * (运行期只依赖 `@sema-agent/core`;另一处 import 是纯类型的编译期门),全部决定口共用一个定义。
  *
  * ## 为什么是「事实」而不是「结算词」(core 7.6.0 / [ref] S6-A,BREAKING)
  *
@@ -14,17 +15,15 @@
  * ⇒ 本仓的规则从「记住一张词×决定的相容表」变成「说出你知道的那两件事」。相容性也不再靠记忆:一次
  * sweep 不可能 `allow`,core pre-CAS 拒。
  */
-import { type AskOutcome, type ResumeOutcome } from "@sema-agent/core";
+import { type AskOutcome, type HostDecider, type PermissionResult, type ResumeOutcome } from "@sema-agent/core";
 /**
  * 谁结束了这次等待,以及通道自报的归属。
- *  · `decidedBy: "person"` —— 运维经审批通道做的决定(两条 HTTP `/decide` 腿);
+ *  · `decidedBy: "person"` —— 一个人经审批通道做的决定(决定体缺席 `decidedBy` 即此);
  *  · `decidedBy: "sla_timeout"` —— 宿主自己的 SLA 扫在行的 deadline 上判的(FACET A;**只有** sweep 能这么说,
- *    而 sweep 结构上不能 `allow`)。
- *  · `decidedBy: "policy"`(core 7.26.2 / #1016)—— **这台部署自己的策略**拒的:答话的是机器不是人。调用方
- *    经决裁体的 `settledBy` 自报;core 据它给模型铸一句**策略句**(而不是「用户不同意,停下来等他」),
- *    并把结算记成 `policy_refused`(`who.party:"policy"`,core 7.39.0 #1265 起;此前 `"none"`)。`allow` 侧:core 7.39.0 起引擎收策略的
- *    放行(`policy_allowed`),但本仓的两条 decide 口**不开**这一形(`tool-approval.ts` 的 `SETTLED_BY_ONLY_ON_DENY` 与店列的同一条拒仍在 ——
- *    耐久车道上的机器放行是一件没裁过的新能力,不在 7.113.0 提货批内,候登)。
+ *    而 sweep 结构上不能 `allow`;wire 上永不受理,见 {@link APPROVAL_DECIDED_BY})。
+ *  · `decidedBy: "policy"` —— **这台部署自己的策略**答的:答话的是机器不是人,`allow` 与 `deny` 两向都可以。
+ *    调用方经决定体的 `decidedBy` 陈述;core 据它铸 `policy_allowed` / `policy_refused`(`who.party:"policy"`),
+ *    拒的那一向给模型一句**策略句**(而不是「用户不同意,停下来等他」)。
  *  · `approver` —— 通道自报的结算方标识串。**缺席永不读成**「没人批」或「有人批」,只意味着通道没报名字。
  */
 /**
@@ -33,9 +32,9 @@ import { type AskOutcome, type ResumeOutcome } from "@sema-agent/core";
  *  · **铸**(本仓自己观察到的事实):只有 `"timeout"` —— 同步 `onAsk` 腿的等待窗归**宿主**所有(引擎不为
  *    一个它没排程的回调起表),所以「本仓的 TTL 窗走完了、没人答」这件事引擎结构上观察不到,不自报就
  *    永远被记成「一个人拒绝了」;
- *  · **转**(调用方在回决体里自报的事实,core 7.26.2 / #1016 起):`settledBy:"policy"` = 答这张卡的是
- *    **这台部署自己的策略**,不是人。本仓**零判据、原样过境**:词的拒绝逻辑归引擎(`resolveAsk` 对
- *    自报词表外的值是响亮 fail-closed deny),本仓抄一份词表的那天 core 加词就会被静默 400 掉。
+ *  · **转**(调用方在决定体里陈述的事实):决定体的 `decidedBy:"policy"` 经 {@link liveSettledBy} 落成这一格的
+ *    `"policy"` = 答这张卡的是**这台部署自己的策略**,不是人。wire 上的词只有 {@link APPROVAL_DECIDED_BY} 两个,
+ *    映射只有那一只函数 —— 这一格的「转」不再是一个原样过境的串。
  * 逐词(词表属主恒是 core):
  *  · `"human"` —— 与「不铸这个键」逐字同义(core 缺席即按人处理);
  *  · `"aborted"` —— core **明令拒收**宿主自报(那是引擎自家 fail-closed 端的词,宿主自报等于把自己的
@@ -48,27 +47,116 @@ import { type AskOutcome, type ResumeOutcome } from "@sema-agent/core";
  * 🔴 **S-558:为什么这一格住在本叶子模块**(此前是 `tool-approval.ts` 的模块私有型):来源位随决议
  * **落持久行**之后,店(`src/plugins/approval-ask-store-sql.ts` 的 `AskRow.settledBy` /
  * `DecideAskInput.settledBy`)与协调器都要说同一个型 —— 而店不能反向依赖协调器。本模块只依赖
- * `@sema-agent/core`,与同住的 {@link HostDecidedBy}(耐久腿的同位事实)恰好是一对:一条决议的来源
+ * `@sema-agent/core`,与同住的 {@link HostDecision}(耐久腿的同位事实)恰好是一对:一条决议的来源
  * 在两条腿上是同一件事,型也该在同一处。
  */
 export type HostSettledBy = NonNullable<Extract<AskOutcome, {
     allow: boolean;
 }>["settledBy"]>;
-/** 直接取 core `ResumeOutcome` policy_ask 臂的 `hostDecision` 型 —— 本仓不复述那几个词(第二铸点)。 */
+/** 直接取 core `ResumeOutcome` policy_ask 臂的 `hostDecision` 型 —— 本仓不复述那几个词(第二铸点)。它的 `decidedBy` 就是 core 的 `HostDecider`
+ *  (core 7.45.0 #1387:三个型位读同一只闭集)。**谁结束了这次等待**的闭集只有 core 包根那一只(`HOST_DECIDERS` / `HostDecider` / `isHostDecider`)。 */
 export type HostDecision = Extract<ResumeOutcome, {
     gate: "policy_ask";
 }>["hostDecision"];
-/** **谁结束了这次等待**的闭集,型从 core 的那一格派生(本仓永不抄词表:core 加/退一个词,读它的每一处
- *  编译期先红)。今天 = `"person"` | `"sla_timeout"` | `"policy"`。 */
-export type HostDecidedBy = HostDecision["decidedBy"];
 /**
- * 一次 decide 的事实,**一处成形**(两条 HTTP decide 腿 + 活卡 PARKED 赎回席共用)。
+ * ══ 决定体的出处位 `decidedBy`:一只闭集、一只读法、一只映射 ═══════════════════════════════════════════════
  *
- * `decidedBy` = 调用方**陈述**的决策者(缺席 ⇒ `"person"`,= 本面自古以来的形:一条不说话的 decide 就是
- * 一个人按的)。🔴 **本仓零判据**:词表的属主是 core,不认识的词由它 pre-CAS 响亮拒
- * (`checkpoint.invalid_outcome`,`hostDecision.decidedBy … is outside the closed set`)。在这里再判一次
- * 就是同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加第四个词就会被
- * 静默 400 掉 —— 那正是 #1016 的 `"policy"` 加进来时本可以发生的事。
+ * 规则一句话:**一个审批决定用一只键说是谁做的** —— `decidedBy ∈ {"person","policy"}`,缺席 = `"person"`;读它的只有
+ * {@link readDecidedBy}(三条工具审批决定口共读:live `POST /v1/tool-approvals/:id/respond`、耐久 ask 账
+ * `POST /v1/tasks/:id/asks/:askId/decision`、耐久 `POST /v1/approvals/:sessionId/decide`),把它交给引擎的只有
+ * {@link liveSettledBy}(同步座 `AskOutcome.settledBy`)与 {@link hostDecisionFacts}(停驻座 `hostDecision.decidedBy`)。
+ *  · 词与决定动词**正交**:策略可以放行也可以拒(core 7.39.0 起引擎铸 `policy_allowed` / `policy_refused`)。唯一的例外是
+ *    引擎自己的那一条 —— 一张要人的卡(`requiresRealApproval`)不归策略答,见 {@link heldAskOf}(判官是 core 的 `policyCannotAnswer`)。
+ *  · `"sla_timeout"` **永不从 wire 收**:那是「等待到点、没人答」,只有本服务自己的截止扫说得出来(`approval-sweeps.ts`
+ *    直接铸 `{decidedBy:"sla_timeout"}`,不经本读法)。调用方说它 = 替服务端伪证一件只有服务端看得见的事。
+ *  · `plan_review` 不读这只键:引擎的 plan_review 结局形没有决定者位(core 的结局规整会把别的键整只重建掉),收下它就是
+ *    一句「已记」的空话。那一门照兄弟门字段那一族拒(`approvals-assistant.ts` 的回决门族派生),候 core 给座。
+ *
+ * 词表的来源:core 包根的 `HOST_DECIDERS` / `HostDecider` / `isHostDecider`(core 7.45.0 #1387;此前包根只有型,本仓手写一只闭集常量 + 两道
+ * 编译门双向咬它 —— 那份手抄随本版退役)。wire 闭集 = 那只词表去掉扫的那一个词,运行期值与型都从它派生,没有第二份词表。
+ */
+/** 只有本服务自己的截止扫说得出的那一个词 —— core 词表里唯一不上 wire 的成员(`satisfies`:core 改名 / 退役它 ⇒ 这里编译红)。 */
+declare const SWEEP_ONLY_DECIDER = "sla_timeout";
+/** wire 上的出处词(决定体 `decidedBy` 的值域)= core 闭集去掉扫的那一个。 */
+export type ApprovalDecidedBy = Exclude<HostDecider, typeof SWEEP_ONLY_DECIDER>;
+/** wire 闭集的运行期值:core `HOST_DECIDERS`(#1387)去掉扫的那一个,顺序随 core。core 加一个词 ⇒ 它在这里自动在场(决定口的门照收;两只座的映射
+ *  {@link liveSettledBy} 的穷举 `switch` 编译红,由人裁它在同步座上怎么落)。 */
+export declare const APPROVAL_DECIDED_BY: readonly ApprovalDecidedBy[];
+/** 闭集外的拒句(三条决定口同一句;码按各口既有约定,见 {@link readDecidedBy})。成员表派生自 {@link APPROVAL_DECIDED_BY}(词表一个来源;今天字节与 7.118.0 同)。 */
+export declare const DECIDED_BY_OUTSIDE_CLOSED_SET: string;
+/** 直连门上的拒句(与 `remember` / `updatedInput` / `checkpointToken` 同族:键不在决策证明的签名载荷里)。 */
+export declare const DECIDED_BY_NOT_IN_PROOF = "decidedBy is not supported on a direct-door worker (not covered by the decision proof)";
+/** 一张要人的卡上策略的放行(两条决定口同一句;判官 core `policyCannotAnswer`,问形见 {@link heldAskOf})。 */
+export declare const POLICY_CANNOT_ALLOW_PERSON_ASK = "decidedBy \"policy\" cannot allow this ask \u2014 it demands a person's approval (risk.requiresRealApproval), and a policy's answer is not a person's; answer it as a person, or refuse it as the policy";
+/**
+ * 退役键 `settledBy`(7.93.3–7.117.x 的「只配 deny」那一位)的拒句。三条决定口共用这一句,出句的铸点是 {@link retiredDecisionKeyFacts}(各口不直接引用本常量)。
+ * live `/respond` 的解析不是键闭集的(未知键一律忽略),而这只键不是随便一个未知键:它是调用方在**明确陈述**「这是策略答的」—— 忽略它就是把缺席律(person)
+ * 套在一个说了话的体上(旧壳的策略拒记成人拒;一张要人的卡上旧形的放行被读成人的放行,绕过「要人的卡不归策略答」那一判)。所以那条口
+ * 在裁决之前响亮拒它,与同一只 parser 里 `scope` 的拒同一条先例;耐久两口本来就在键闭集 / strict 体上拒它,句子改由同一铸点出。
+ */
+export declare const SETTLED_BY_RETIRED = "settledBy is retired \u2014 send decidedBy: \"person\" | \"policy\" (who made this decision; absent = \"person\"); ignoring it would record a policy's answer as a person's";
+/**
+ * 退役键 `settledBy` 的**拒绝事实** —— 三条工具审批决定口(live `POST /v1/tool-approvals/:id/respond`、耐久 ask 账
+ * `POST /v1/tasks/:taskId/asks/:askId/decision`、`POST /v1/approvals/:sessionId/decide`)对它的拒,**句**与**机读位**同出自这一处:
+ *  · `error` = {@link SETTLED_BY_RETIRED}(三口同一句,没有哪一口自说一句 —— 此前耐久 ask 账说 strict 体的通用句、`/decide` 说键闭集句);
+ *  · `extra` = `{ field: "settledBy" }`,直接作 `sendError` 的 `extra` / 并进 400 体。`field` 是 400 体上既有的那一把键(`request.field_invalid` 的
+ *    `settings.permissions.*` / `settings.hooks` / 模型位同键同读法:点名这只拒落在请求体里哪个字段上),不另造码、不另造键。
+ * 码三口同为 `request.body_shape`;`/decide` 照旧另带 `unknownKeys` / `unsupportedKeys` 两张键表(退役键仍在 `unknownKeys` 里)。
+ * 判在场的口径只有一个:值不是 `undefined`(JSON 里的 `null` / `""` 也算在场 —— 退役键是一句**陈述**,不看它陈述了什么)。
+ * 用法(两种出口,各口都只**带**、不改):① 拒的成因就是退役键(live 解析器撞上它 / 耐久 ask 账 strict 解析失败而体里有它 / `/decide` 键闭集门)⇒ 句用 `error`、
+ * 体并 `extra`;② 体里同时还有别的毛病而先撞上的是那一个(live 解析器的 `note` / `persistRule` / 决定词,`/decide` 的根形门)⇒ 句仍说那个毛病、体照并 `extra` ——
+ * 每个口在自己的**失败出口**调同一只函数,而不是在某条判定的分支里调,否则「机读位在不在」就取决于哪句先撞上。
+ */
+export declare const RETIRED_DECISION_KEY: "settledBy";
+export interface RetiredDecisionKeyFacts {
+    readonly error: typeof SETTLED_BY_RETIRED;
+    readonly extra: {
+        readonly field: typeof RETIRED_DECISION_KEY;
+    };
+}
+export declare function retiredDecisionKeyFacts(body: unknown): RetiredDecisionKeyFacts | undefined;
+/** {@link readDecidedBy} 的判决(调用点做穷举 `switch` + `never` 兜底,各按自己的码约定发出)。 */
+export type DecidedByReading = {
+    kind: "accepted";
+    decidedBy: ApprovalDecidedBy;
+} | {
+    kind: "not_in_proof";
+} | {
+    kind: "outside_closed_set";
+};
+/**
+ * 决定体 `decidedBy` 的**唯一读法**。次序即契约:
+ *  ① 缺席 ⇒ `"person"`(缺席律:一条不说话的决定就是一个人按的 —— 与修前逐字同形);
+ *  ② 直连门在场且键在场 ⇒ `not_in_proof`(不论值:它不在签名载荷里,能改线上字节的一方可以把人翻成策略;
+ *     第二参给字面 `false` 的调用点 = 那条口没有决策证明,live `/respond` 即此);
+ *  ③ 闭集内 ⇒ 那个词;其余一切(`"sla_timeout"`、结算词、别的串、非串、`null`)⇒ `outside_closed_set`。
+ */
+export declare function readDecidedBy(raw: unknown, directDoorActive: false): Exclude<DecidedByReading, {
+    kind: "not_in_proof";
+}>;
+export declare function readDecidedBy(raw: unknown, directDoorActive: boolean): DecidedByReading;
+/**
+ * **同步座的映射**(`AskOutcome.settledBy`;ask 账行的 `settled_by` 列存的也是这一格):`person` ⇒ 不铸键(引擎缺席即按人读,
+ * 与修前逐字同形 —— 人的放行仍是裸 `true`),`policy` ⇒ `"policy"`。总函数,无 cast。
+ */
+export declare function liveSettledBy(decidedBy: ApprovalDecidedBy): Extract<HostSettledBy, "policy"> | undefined;
+/**
+ * 引擎自己的那一条例外:**一张要人的卡不归策略答** —— 判官是 core 的 `policyCannotAnswer(question, decidedBy)`(#1395 包根导出;引擎的续跑入口、
+ * 执行带与同步座读同一条)。本仓**只在自己的副作用先于引擎落地的两条口**上于裁决之前问它(live `/respond`:会话放行 / 常驻规则 / 一条按 approve
+ * 回放的 DECIDED 行;耐久 ask 账:一条宣称 approve 的 DECIDED 行),并且只问**放行**那一向(与引擎续跑入口同:拒永远答得了)。耐久 `/decide` 不判:
+ * 引擎在 CAS 之前就拒(`checkpoint.invalid_outcome`,卡留 pending),本口的副作用全在引擎受理之后 —— 在那里再问一次就是第二个判官。
+ *
+ * 交给判官的「问」= {@link heldAskOf}:本仓两条口持有的都不是引擎的原物(活卡条目记的是铸条目那一次从 `AskRequest` 读定的那一位;耐久 ask 账行上是
+ * 卡面 `risk.requiresRealApproval`,读不出按要人读),以引擎的问形(core `HeldQuestion` 的 `ask` 决定臂)交过去 —— 「谁答不了」只在引擎那一处判。
+ */
+export declare function heldAskOf(demandsAPerson: boolean): Extract<PermissionResult, {
+    action: "ask";
+}>;
+/**
+ * 一次 decide 的**停驻座事实**,一处成形(耐久 `/decide` 与活卡 PARKED 赎回席共用;截止扫直接铸 `{decidedBy:"sla_timeout"}`)。
+ *
+ * `decidedBy` = 已经过 {@link readDecidedBy} 的 wire 词:两个词在停驻座上**就是它自己**(`person` / `policy`,
+ * 两只词表的交集由上面的编译期门证),所以这里没有 cast,也没有缺席律(缺席已在读法里落成 `"person"`)。
  *
  * `principal` = 那条腿已经验过身份的决策者(缺席 = 匿名档的部署,通道确实没有名字可报)。
  * 归属串走 core 的 `screenApproverAttribution` **先筛后带**:core 对形不合的归属是 pre-CAS 响亮拒,
@@ -76,14 +164,9 @@ export type HostDecidedBy = HostDecision["decidedBy"];
  * 被改造过的串):归属是转录,不是可以「修一修」的东西 —— 修出来的名字既不是通道报的那个,也不是
  * 「通道没报」,两头都不真。
  *
- * 🔴 归属**不按词分岔**:core 7.38.x 的 `policy_refused` 结算记录上没有归属席(`who.party:"none"`),7.39.0 #1265 起有了
- * (`who.party:"policy"`,`approver?`)—— 无论 core 的记录怎么写,**本服务观察到的事实**不变:送出这次请求的那把已验证身份是真的,本仓的
+ * 🔴 归属**不按词分岔**:无论 core 的记录怎么写,**本服务观察到的事实**不变:送出这次请求的那把已验证身份是真的,本仓的
  * 迟到结算账本(`approval-ask-audit-store.ts`)记的就是它。按词删一格 = 给账本挖一个只在某个词上出现的洞。
- *
- * 🔴 **入参是 `string`,不是 `HostDecidedBy` —— 这一格刻意让类型说真话**(wire 边界强类型宪法):两条
- * decide 腿能证得出的只有「调用方给了个串」(形门在各自的口上),**证不出**它是词表成员;把参数声明成
- * 闭集就是让类型替一件本层从没做过的检查背书。⇒ 收 `string`,在**这一处**(本座的边界)做唯一一次 cast,
- * 而那次 cast 说的是「我把一个未判词的串放到只收词的座上,判词的是座的属主(core,pre-CAS 响亮拒)」。
  */
-export declare function hostDecisionFacts(decidedBy: string | undefined, principal: string | undefined): HostDecision;
+export declare function hostDecisionFacts(decidedBy: ApprovalDecidedBy, principal: string | undefined): HostDecision;
+export {};
 //# sourceMappingURL=host-decision.d.ts.map

package/dist/host-decision.js

@@ -1,6 +1,43 @@
-import { screenApproverAttribution } from "@sema-agent/core";
+import { HOST_DECIDERS, isHostDecider, screenApproverAttribution } from "@sema-agent/core";
+const SWEEP_ONLY_DECIDER = "sla_timeout";
+function isApprovalDecidedBy(v) {
+    return isHostDecider(v) && v !== SWEEP_ONLY_DECIDER;
+}
+export const APPROVAL_DECIDED_BY = Object.freeze(HOST_DECIDERS.filter(isApprovalDecidedBy));
+export const DECIDED_BY_OUTSIDE_CLOSED_SET = `decidedBy must be ${APPROVAL_DECIDED_BY.map((w) => `"${w}"`).join(" or ")} when present — who made this decision: a person, or this deployment's own policy (absent = "person"); "${SWEEP_ONLY_DECIDER}" is never accepted from a caller (only this server's own deadline sweep says a wait ended with nobody answering)`;
+export const DECIDED_BY_NOT_IN_PROOF = "decidedBy is not supported on a direct-door worker (not covered by the decision proof)";
+export const POLICY_CANNOT_ALLOW_PERSON_ASK = 'decidedBy "policy" cannot allow this ask — it demands a person\'s approval (risk.requiresRealApproval), and a policy\'s answer is not a person\'s; answer it as a person, or refuse it as the policy';
+export const SETTLED_BY_RETIRED = 'settledBy is retired — send decidedBy: "person" | "policy" (who made this decision; absent = "person"); ignoring it would record a policy\'s answer as a person\'s';
+export const RETIRED_DECISION_KEY = "settledBy";
+export function retiredDecisionKeyFacts(body) {
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return undefined;
+    return body[RETIRED_DECISION_KEY] !== undefined ? { error: SETTLED_BY_RETIRED, extra: { field: RETIRED_DECISION_KEY } } : undefined;
+}
+export function readDecidedBy(raw, directDoorActive) {
+    if (raw === undefined)
+        return { kind: "accepted", decidedBy: "person" };
+    if (directDoorActive)
+        return { kind: "not_in_proof" };
+    return isApprovalDecidedBy(raw) ? { kind: "accepted", decidedBy: raw } : { kind: "outside_closed_set" };
+}
+export function liveSettledBy(decidedBy) {
+    switch (decidedBy) {
+        case "person":
+            return undefined;
+        case "policy":
+            return "policy";
+        default: {
+            const unreachable = decidedBy;
+            throw new Error(`liveSettledBy: unknown decidedBy ${String(unreachable)}`);
+        }
+    }
+}
+export function heldAskOf(demandsAPerson) {
+    return demandsAPerson ? { action: "ask", requiresRealApproval: true } : { action: "ask" };
+}
 export function hostDecisionFacts(decidedBy, principal) {
     const screened = screenApproverAttribution(principal);
-    return { decidedBy: (decidedBy ?? "person"), ...(screened.approver !== undefined ? { approver: screened.approver } : {}) };
+    return { decidedBy, ...(screened.approver !== undefined ? { approver: screened.approver } : {}) };
 }
 //# sourceMappingURL=host-decision.js.map

package/dist/http/admission.js

@@ -1,8 +1,8 @@
-import { MCP_IMAGE_MAX_BASE64, isThinkingLevel, expandTiers } from "@sema-agent/core";
+import { APPROVAL_REACH, MCP_IMAGE_MAX_BASE64, isApprovalReach, isPermissionMode, isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import * as facts from "../capability-facts.js";
@@ -14,6 +14,7 @@ import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
 import { resolveDevicePlacementIntent } from "./device-placement.js";
 import { sendError, httpErrorCode } from "./send.js";
+const APPROVAL_REACH_WORDS = APPROVAL_REACH.map((word) => JSON.stringify(word)).join(" / ");
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
 export const MAX_SYSTEM_PROMPT_CHARS = 16_384;
 export const MAX_OUTPUT_SCHEMA_CHARS = 32_768;
@@ -470,6 +471,11 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.field_invalid", "interactiveTools must be a boolean");
             return null;
         }
+        const approvalReach = body.approvalReach;
+        if (approvalReach !== undefined && !isApprovalReach(approvalReach)) {
+            sendError(res, 400, "request.field_invalid", `approvalReach must be ${APPROVAL_REACH_WORDS} when present (the run declares that nobody on it can be asked to approve; omit the key otherwise)`);
+            return null;
+        }
         if (body.oneShot !== undefined && typeof body.oneShot !== "boolean") {
             sendError(res, 400, "request.field_invalid", "oneShot must be a boolean");
             return null;
@@ -518,8 +524,8 @@ export function createAdmission(ctx) {
         }
         {
             const v = body.permissionMode;
-            if (v !== undefined && !isSettingsPermissionMode(v)) {
-                sendError(res, 400, "request.field_invalid", `permissionMode must be one of ${SETTINGS_PERMISSION_MODE_WORDS}`);
+            if (v !== undefined && !isPermissionMode(v)) {
+                sendError(res, 400, "request.field_invalid", `permissionMode must be one of ${PERMISSION_MODE_WORDS}`);
                 return null;
             }
         }
@@ -529,8 +535,8 @@ export function createAdmission(ctx) {
                 const p = s.permissions;
                 if (p !== null && typeof p === "object" && !Array.isArray(p)) {
                     const m = p.defaultMode;
-                    if (m !== undefined && !isSettingsPermissionMode(m)) {
-                        sendError(res, 400, "request.field_invalid", `settings.permissions.defaultMode must be one of ${SETTINGS_PERMISSION_MODE_WORDS}`);
+                    if (m !== undefined && !isPermissionMode(m)) {
+                        sendError(res, 400, "request.field_invalid", `settings.permissions.defaultMode must be one of ${PERMISSION_MODE_WORDS}`);
                         return null;
                     }
                     const d = p.disableAutoMode;

package/dist/http/approval-sweeps.js

@@ -150,7 +150,7 @@ export function createApprovalSweeps(ctx) {
             ...(req.gateBoundInputHash !== null ? { boundInputHash: req.gateBoundInputHash } : {}),
             ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
         };
-        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.settledBy, req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
+        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.decidedBy, req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
         return { status: out.status, body: out.body };
     }
     return { denyExpiredApprovals, redeemParkedAsk };

package/dist/http/mcp-dial-deadline.d.ts

@@ -0,0 +1,35 @@
+/**
+ * S-431 —— 一条 HTTP 请求愿意等**一次远端 MCP 拨号**多久:**一只数、一只 helper**,两口共读。
+ *
+ * 同一类动作(连一台远端 MCP 服务器 + 列它的工具)在本仓有两张 HTTP 面:
+ *  · `GET /v1/sessions/:id/mcp` 面板(`routes/sessions.ts`)—— 物化部署缺省场景的申报,到点答 200 `degraded:true`;
+ *  · `POST /v1/sessions/:id/mcp/reconnect`(`routes/mcp-reconnect.ts`)—— 在飞 run 上重拨一台,到点答 503。
+ * 修前面板有期限、reconnect 是裸 `await`(S-431):同一件事两个读法,一台拨不通 / 半开的远端能把后者挂很久。
+ * 两口各自**到点答什么**不同(面板是只读的部署面,有一个诚实的空形;reconnect 是一次交易,没有结果就没有
+ * 一个能当 `outcome` 的词)—— 但**等多久**是一个事实,所以只有一个数。
+ *
+ * 🔴 **这是常量,不是旋钮**:没有 env、不进 config-catalog。要调窗就改这一处,两口一起动。
+ * (底层拨号自己的上界是 core 的启动期钟 —— env `MCP_TIMEOUT`,未设落 SDK 缺省 —— 与本数无关:本数只界
+ * **HTTP 应答**,不界拨号;见 {@link raceDeadline}。)
+ *
+ * helper 收的是期限**参数**而不是自己读上面那个常量:调用点把 {@link MCP_DIAL_DEADLINE_MS} 显式交下来,
+ * `test/mcp-reconnect-deadline.test.ts` 的静态钉就是「每个远端 MCP 拨号调用点都把它交给 `raceDeadline`」。
+ */
+/** 一次远端 MCP 拨号的 HTTP 应答期限(毫秒)。面板与 reconnect 共读;**全仓只有这一处写它**。 */
+export declare const MCP_DIAL_DEADLINE_MS = 10000;
+/** `work` 没在期限内落定。**具名型**:调用腿据它分诊,不比对错误文案。 */
+export declare class DeadlineExceeded extends Error {
+    readonly boundMs: number;
+    constructor(boundMs: number);
+}
+/**
+ * 让**应答**不再等 `work`:`work` 先落定就原样交出(resolve / reject 都不变形),期限先到就 reject
+ * {@link DeadlineExceeded}。
+ *
+ * 🔴 **只界应答,不取消 `work`**:本函数不持有任何取消把手 —— core 的 `TaskStream.reconnectMcpServer` 与
+ * `materializeMcpTools` 都不收 `AbortSignal`(d.ts 逐字),所以期限到点后底层拨号**继续跑**,落定时
+ * 才释放它占的连接 / 子进程。调用点必须把这句话交代给调用方(reconnect 的 503 文案、契约 §G.7c)。
+ * 迟到的落定(尤其迟到的 reject)挂一条吞掉,免得没人 await 它时变成未处理拒绝。
+ */
+export declare function raceDeadline<T>(work: Promise<T>, deadlineMs: number): Promise<T>;
+//# sourceMappingURL=mcp-dial-deadline.d.ts.map

package/dist/http/mcp-dial-deadline.js

@@ -0,0 +1,21 @@
+export const MCP_DIAL_DEADLINE_MS = 10_000;
+export class DeadlineExceeded extends Error {
+    boundMs;
+    constructor(boundMs) {
+        super(`did not settle within ${boundMs}ms`);
+        this.boundMs = boundMs;
+        this.name = "DeadlineExceeded";
+    }
+}
+export function raceDeadline(work, deadlineMs) {
+    let timer;
+    const deadline = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new DeadlineExceeded(deadlineMs)), deadlineMs);
+    });
+    work.catch(() => undefined);
+    return Promise.race([work, deadline]).finally(() => {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    });
+}
+//# sourceMappingURL=mcp-dial-deadline.js.map

package/dist/http/memory-compliance-failure-reply.d.ts

@@ -10,21 +10,24 @@
  *
  * ## 规则(三层,与 operator 面既有层序逐字同序)
  *  ① core 的**本口专属**码(闭集穷举 `switch`,见 {@link sentCoreCode})—— 码与状态两面同;文案按受众(下一节,一条规则);
- *  ② `memory.target_outside_store`(core 7.31.1 #1094 跨面 store 状态码)—— 409;
+ *  ② **店形拒**两码 `memory.target_outside_store`(core 7.31.1 #1094)/ `memory.scope_home_not_directory`(core 7.44.0 #1368)—— 跨面 store 状态码,409、码原样
+ *     (判据 `memory-store-refusal.ts` 一只;运维行 `memory_store_form_refused { code, path?, form? }` 两受众同一只铸点,路径只在那里);
  *  ③ `ControlPlaneCorruptError` —— typed 500 `internal.memory_control_plane_corrupt`(fail-closed 信号,一码两义见下);
  *  其余 ⇒ `false`(未分类,调用方发它自己那句 500 且**不回显**内部文本)。
  *
  * ## 文案按受众分(码与状态不分)—— **一条规则,三层同施,不按码挑**(F9,7.108.0 合并复审 opus 腿 O-9)
- * core 原句是写给运维的诊断材料:② ③ 点名**宿主路径**(store 根、链解析到哪 / 控制面账本文件),① 的 `selector_mismatch` 带**首个请求的
+ * core 原句是写给运维的诊断材料:③ 点名**宿主路径**(控制面账本文件;② 自 core 7.44.0 起句子不带路径、路径在 `detail.path` ⇒ 运维行),① 的 `selector_mismatch` 带**首个请求的
  * 选择子哈希**(`pinned set <selectHash>`,无盐 sha256 —— operator 选择子可字典还原,首个请求未必是这位会话所有者发的):
  *  · operator 受众 ⇒ 原句上 wire(过了 operator 门,这些材料对这个受众不是泄露);
  *  · 会话所有者受众 ⇒ **一律**一句固定指路(每码一句,只说「怎么办」),原句整句交 `withheld` 落运维 warn —— 不逐码判断哪句安全
  *    (逐码挑 = core 改一句文案就可能静默漏出一样新东西)。② ③ 的固定句**两形都真**:
- *    ② 链先于请求在场 ⇒ 提交点之前拒、什么都没做;提交点之后才换上的链 ⇒ 已删的几条算数、journal 留盘(codex 一审 C1);
+ *    ② 链先于请求在场 ⇒ 提交点之前拒、什么都没做;提交点之后才换上的链 ⇒ 已删的几条算数、journal 留盘(codex 一审 C1);scope home 不是真目录那一句
+ *       同样不许诺零删除(home 被换掉的时刻本层判不出),只指路「运维放回真目录后用同一个 requestId 重发」;
  *    ③ 一码两义 —— 操作前账本读不出 ⇒ 什么都没发生;落定后残留枚举失败 ⇒ 抹除已提交、重放收敛(core 原话)。两句都不许诺零删除,
  *    都指路「运维修好后用同一个 requestId 重发」(两义下这句都对)。本层**不**嗅 core 文案分辨前后(拿上游自由文本当判别式是第二真源)。
  */
 import type { ServerResponse } from "node:http";
+import type { Logger } from "../observability/logger.js";
 /**
  * 已分类拒 → HTTP 状态的**唯一**码表 = 自铸 wire 值登记处的 `sessionMemoryEraseStatus` 集(F3:wire 变更清单从同一张表 diff,状态改一处、
  * 清单跟着列)。两面同读(S-930:码与状态只判一次)。键写错 ⇒ tsc 红(索引的是 `as const` 表的键)。
@@ -36,6 +39,9 @@ export type MemoryComplianceAudience = {
     readonly kind: "session_owner";
     readonly withheld: (coreMessage: string) => void;
 };
-/** 按上面三层应答;返回 `true` = 已应答,`false` = 未分类(一个字节都没写,调用方发它自己那句 500 并落它自己的运维 warn)。 */
-export declare function sentMemoryComplianceFailure(res: ServerResponse, err: unknown, audience: MemoryComplianceAudience): boolean;
+/**
+ * 按上面三层应答;返回 `true` = 已应答,`false` = 未分类(一个字节都没写,调用方发它自己那句 500 并落它自己的运维 warn)。
+ * `logger` = 店形拒那一条运维行的去处(两受众同一只;缺席 ⇒ 不落)。
+ */
+export declare function sentMemoryComplianceFailure(res: ServerResponse, err: unknown, audience: MemoryComplianceAudience, logger: Pick<Logger, "warn"> | undefined): boolean;
 //# sourceMappingURL=memory-compliance-failure-reply.d.ts.map

package/dist/http/memory-compliance-failure-reply.js

@@ -1,5 +1,5 @@
 import { ControlPlaneCorruptError } from "@sema-agent/core";
-import { targetOutsideStoreOf } from "../memory-store-refusal.js";
+import { logStoreFormRefusal, storeFormRefusalOf } from "../memory-store-refusal.js";
 import { sentMemoryStoreRefusal } from "./memory-store-refusal-reply.js";
 import { sendError } from "./send.js";
 import { assertNever } from "./route-ctx.js";
@@ -38,19 +38,28 @@ function codeOf(err) {
     const { code } = err;
     return typeof code === "string" ? code : undefined;
 }
-export function sentMemoryComplianceFailure(res, err, audience) {
+export function sentMemoryComplianceFailure(res, err, audience, logger) {
     const coreCode = codeOf(err);
     if (coreCode !== undefined && sentCoreCode(res, coreCode, err instanceof Error ? err.message : String(err), audience))
         return true;
-    const outside = targetOutsideStoreOf(err);
-    if (outside !== undefined) {
+    const storeForm = storeFormRefusalOf(err);
+    if (storeForm !== undefined) {
         switch (audience.kind) {
             case "operator":
-                return sentMemoryStoreRefusal(res, err);
+                return sentMemoryStoreRefusal(res, err, logger);
             case "session_owner":
-                audience.withheld(outside.message);
-                sendError(res, 409, "memory.target_outside_store", "session memory erasure refused — a directory in this deployment's memory store leads outside it (a link), so this erasure did not complete (a refusal before its commit point changed nothing; one after it keeps the deletions already made and a journal that finishes the rest once the link is removed); ask the operator to remove the link, then resend with the same requestId");
-                return true;
+                logStoreFormRefusal(logger, storeForm);
+                audience.withheld(storeForm.message);
+                switch (storeForm.code) {
+                    case "memory.target_outside_store":
+                        sendError(res, 409, "memory.target_outside_store", "session memory erasure refused — a directory in this deployment's memory store leads outside it (a link), so this erasure did not complete (a refusal before its commit point changed nothing; one after it keeps the deletions already made and a journal that finishes the rest once the link is removed); ask the operator to remove the link, then resend with the same requestId");
+                        return true;
+                    case "memory.scope_home_not_directory":
+                        sendError(res, 409, "memory.scope_home_not_directory", "session memory erasure refused — a scope directory in this deployment's memory store is not a real directory (it was replaced by a link or a file), so this erasure did not complete; ask the operator to put the real directory back, then resend with the same requestId");
+                        return true;
+                    default:
+                        return assertNever(storeForm.code);
+                }
             default:
                 return assertNever(audience);
         }

package/dist/http/memory-store-refusal-reply.d.ts

@@ -1,24 +1,27 @@
 /**
- * core 7.31.1 #1094 `memory.target_outside_store` 的 **operator 面 HTTP 映射** —— 唯一一处字面量(判据在
- * `src/memory-store-refusal.ts`)。挂在每一个触 store 树的 operator 记忆口的已分类收尾上:
+ * **店形拒**两码(`memory.target_outside_store` / `memory.scope_home_not_directory`,判据在 `src/memory-store-refusal.ts`)的
+ * **operator 面 HTTP 映射** + 两受众共用的**运维行** —— 唯一一处码字面量。挂在每一个触 store 树的 operator 记忆口的已分类收尾上:
  * `routes/memory-compliance.ts`(出处 / 抹除;经 `http/memory-compliance-failure-reply.ts` 的 operator 受众臂)· `routes/memory-origin.ts`(外源列表 / 清标;**不含**只读控制面的清标账列表 ——
  * core 的 wire 表逐字:只碰控制面的面不判,给它挂一条永远收不到的码路径正是附录 A 活触发门要防的形)·
- * `routes/memory-bundle.ts`(导出 / 导入)。会话所有者的自助抹除口**不走这里**(S-930 起经 `http/memory-compliance-failure-reply.ts` 的会话所有者受众臂:同码、固定文案)。
+ * `routes/memory-bundle.ts`(导出 / 导入)。会话所有者的自助抹除口**不走这里的 wire 句**(经 `http/memory-compliance-failure-reply.ts` 的会话所有者受众臂:同码、固定文案),
+ * 但运维行({@link logStoreFormRefusal},铸点在 `src/memory-store-refusal.ts`)两受众同一只。
  * `POST /v1/admin/memory/consolidation/run` 也不走这里:那口把 core 的**任何**有码拒一律收成 409 `memory.consolidation_refused`
- * (码进文案,附录 A 该行),本码已在那条臂上,不再给它第二个码。
+ * (码进文案,附录 A 该行),这一族已在那条臂上,不再给它第二个码。
  *
- * ## 为什么 409
- * core 的读法:operator 要处置的拒(去掉 store 里那只通到外面的目录链),不是可重试的 IO 故障,也不是对调用方的裁决。与
+ * ## 为什么 409(两码同一条)
+ * core 的读法:operator 要处置的盘形(去掉 store 里那只通到外面的目录链 / 把 scope home 放回真目录),不是可重试的 IO 故障,也不是对调用方的裁决。与
  * `memory.erasure_census_incomplete` 同一类(**当前 store 状态**下这次做不了;状态修好后重发即改判)⇒ 409,不 500(服务器没坏)、
  * 不 4xx 请求族(请求没写错)。抹除面:链先于请求在场 ⇒ core 在提交点之前拒,零删除、零 journal(真 core 格钉在
  * `test/memory-compliance-http.test.ts`);链在提交点之后才换上 ⇒ 已删的几条算数、journal 留盘 —— core 原句会带
  * `after the commit point; the journal is kept`,本层原样转发、不嗅它分类(codex 一审 C1)。
  *
- * ## 文案原样
- * core 的诊断句点名动作、路径与解析到哪 —— 那是运维找到那只链的唯一材料,与本族其它 core 码同一条「码与文案都不改写」纪律。
- * 只对 operator 面这么做:这几口都过了 operator 门,宿主路径对这个受众不是泄露。
+ * ## 文案原样,路径进运维行
+ * operator 面上 wire 的是 core 原句(码领头;core 7.44.0 起句子里**没有**宿主路径 —— 路径在 `detail.path`)。路径不上 wire(两受众同,裁定:运维腿的
+ * 句子不带服务器路径,路径只进日志):每次应答这一族,{@link logStoreFormRefusal} 落一条运维 warn `memory_store_form_refused { code, path?, form? }` ——
+ * 运维找到那只链 / 那只坏 home 的唯一材料。
  */
 import type { ServerResponse } from "node:http";
-/** `err` 是 `memory.target_outside_store` ⇒ 409 带码 + core 原句,返回 true(已应答);否则 false,一个字节都不写。 */
-export declare function sentMemoryStoreRefusal(res: ServerResponse, err: unknown): boolean;
+import type { Logger } from "../observability/logger.js";
+/** `err` 是店形拒 ⇒ 409 带码 + core 原句 + 运维行,返回 true(已应答);否则 false,一个字节都不写。 */
+export declare function sentMemoryStoreRefusal(res: ServerResponse, err: unknown, logger: Pick<Logger, "warn"> | undefined): boolean;
 //# sourceMappingURL=memory-store-refusal-reply.d.ts.map

package/dist/http/memory-store-refusal-reply.js

@@ -1,10 +1,21 @@
-import { targetOutsideStoreOf } from "../memory-store-refusal.js";
+import { logStoreFormRefusal, storeFormRefusalOf } from "../memory-store-refusal.js";
 import { sendError } from "./send.js";
-export function sentMemoryStoreRefusal(res, err) {
-    const refusal = targetOutsideStoreOf(err);
+export function sentMemoryStoreRefusal(res, err, logger) {
+    const refusal = storeFormRefusalOf(err);
     if (refusal === undefined)
         return false;
-    sendError(res, 409, "memory.target_outside_store", refusal.message);
-    return true;
+    logStoreFormRefusal(logger, refusal);
+    switch (refusal.code) {
+        case "memory.target_outside_store":
+            sendError(res, 409, "memory.target_outside_store", refusal.message);
+            return true;
+        case "memory.scope_home_not_directory":
+            sendError(res, 409, "memory.scope_home_not_directory", refusal.message);
+            return true;
+        default: {
+            const unhandled = refusal.code;
+            throw new Error(`unhandled store-form refusal word: ${String(unhandled)}`);
+        }
+    }
 }
 //# sourceMappingURL=memory-store-refusal-reply.js.map

package/dist/http/resume-legs.js

@@ -1,7 +1,7 @@
 import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { createHash } from "node:crypto";
 import { uuidv7, resumeWithVerification, CheckpointError, defaultTaskRegistry, taskNotificationDedupKey, validatePendingSteer, GLOBAL_USAGE_KEY, PAUSE_REGISTRY } from "@sema-agent/core";
-import { decideParkedAgent, denyWorkflowParksUnreadable, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
+import { decideParkedAgent, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
 const sessionFaceUnavailable = async (sessionId) => {
     throw new Error(`parked decide cannot verify which occupant session ${sessionId} belongs to: this deployment's session store has no sessionFaceOf read (every built-in store has one) — refusing rather than resuming unverified`);
 };
@@ -15,7 +15,7 @@ import { recordResumeResourceWindow } from "../resource-window.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../fleet/subagent-tail-bus.js";
-import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerMayRetire } from "../tool-approval.js";
+import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerDurablyRecordable } from "../tool-approval.js";
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { withPrincipal } from "../observability/principal-context.js";
@@ -41,6 +41,7 @@ import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflic
 import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js";
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
+import { deploymentListAsks } from "../approval.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
 import { resumeBlockedByPolicyAnswer, storedBodyReplayAnswer, storedBodyReplayLogFields, storedBodyReplayRefusal } from "./checkpoint-ctx.js";
 import { httpErrorCode } from "./send.js";
@@ -274,7 +275,7 @@ export function createResumeLegs(ctx) {
         const rememberableTool = paForGrant !== undefined &&
             paForGrant.toolName &&
             paForGrant.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
-            standingAnswerMayRetire(parkRowStandingAnswerFacts(paForGrant, cp.gate, deps.config))
+            standingAnswerDurablyRecordable(parkRowStandingAnswerFacts(paForGrant, cp.gate, deps.config, deploymentListAsks(deps.config, { toolName: paForGrant.toolName })))
             ? paForGrant.toolName
             : null;
         const boundGrant = onResumeCommitted
@@ -345,6 +346,10 @@ export function createResumeLegs(ctx) {
                 void ctxPromise.catch(() => { });
                 return denyWorkflowParksUnreadable(origin);
             }
+            if (origin?.kind === "workflow_park_forked") {
+                void ctxPromise.catch(() => { });
+                return denyWorkflowParkForked(origin);
+            }
             if (origin?.kind === "workflow") {
                 void ctxPromise.catch(() => { });
                 const plan = planWorkflowParkedDecide(origin, parkedReq);