@sema-agent/server 7.117.0 → 7.119.0

package/dist/http/routes/approvals-assistant.d.ts

@@ -3,6 +3,7 @@ import type { QuestionAnswer } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../../plugins/store-backend.js";
 import { type ToolApprovalCoordinator } from "../../tool-approval.js";
 import { type GovernancePosture } from "../../runtime-governance.js";
+import { type GateIntentView } from "../../approval.js";
 import { type RouteCtx, type RouteDecl, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
 import { type KeyClosureIssue } from "../../request-key-closure.js";
 /** 族的成员 = 路由表行 id(改名 / 删行 ⇒ 下表的键当场编译红)。 */
@@ -104,6 +105,27 @@ export declare function checkQuestionAnswer(v: unknown): QuestionAnswerCheck;
 /** 路由体 = 从 `server.ts` 的 `handle()` 里**整段剪切**过来的原文(唯一改动:统一去缩进两格)。裸 `return;`
  *  = 「本域已应答」;走到函数尾才是「没匹配上」。跨域的东西一律在首行解构出来。 */
 export declare function handleApprovalsAssistant(req: IncomingMessage, res: ServerResponse, match: RouteMatch<ApprovalsAssistantRouteId>, ctx: RouteCtx): Promise<void>;
+/**
+ * 🔴 [ref]-2 / [ref]②:两条 durable 读面(`GET /v1/approvals` + `/v1/approvals/stream`)的**唯一**
+ * 投影 —— 脱敏([ref] 件4)+ 出身归因([ref] 的另一半)一次做完。
+ *
+ * 出身格的病灶如实记:`governanceForced` 此前只在 409 体上算(`buildActiveRunConflict`),而运维队列
+ * 的行不算 —— 同一道 park 门,客户端从 409 看得见「这是运维治理层下的」,从队列看不见。它**不是**一个
+ * 落库缺口:判据的两半(行上 `riskDescriptor.shellGateDoctrine` + 本部署的治理姿态)在这条读面上都够得着,
+ * 缺的只是**没有人算**。所以补法 = 让两面共用 `governanceOriginOf` 这一个属主(在读面算的已知失真、
+ * 以及「根治要 core 在 mint 写进行里」的登记,逐字在 `runtime-governance.ts` 那个函数的顶注,不复述)。
+ *
+ * 🔴 `true` 才写键,恒不写 `false` —— 与活卡帧 / 409 体 / `card_json` 同一条纪律:缺席 = 「没有治理来源
+ * 的证据」,不是「这不是治理门」。
+ *
+ * ⚠️ **`delegation` 刻意不在这里**(同批如实登记,禁编造键):park 行上**没有**这条信息 —— core 的
+ * `Checkpoint` / `PendingAction` / `CheckpointGate` 三个面都不带 `{parentToolCallId, depth, agentName}`
+ * (`Checkpoint.state.delegationProvenance` 是 [ref] 的内容安全聚合 `{version, coverageStartTurn,
+ * sawExternal, incomplete}`,与 ask 的出处链是两件事)。同步腿的这一格来自 `AskRequest.delegation`,
+ * 那条路 park 时不随行。⇒ 无供给,诚实缺席;要它得先有 core 侧的属主面。
+ */
+/** 运维队列行投影要的部署事实:治理姿态(出身归因的部署侧一半)+ 三张审批名单(问的属主:部署名单门问不问这一行的调用)。生产两处都递活配置。 */
+export type PendingProjectionDeployment = GovernancePosture & Pick<GateIntentView, "approvalRequire" | "approvalDeny" | "approvalNeverAuto">;
 export declare function streamApprovals(req: IncomingMessage, res: ServerResponse, cs: Pick<CheckpointStoreFull, "listPending">, 
 /**
  * 🔴 S-454:**第二条 diff 源** —— `GET /v1/approvals` 的 `livePending` 那**同一只**读函数
@@ -118,9 +140,9 @@ export declare function streamApprovals(req: IncomingMessage, res: ServerRespons
  * 与 `governance` 同一条理由:`pollMs` 只有测试传,而本参数是每个生产调用点都必须表态的那一个。
  */
 live: Pick<ToolApprovalCoordinator, "listLivePending"> | undefined, scope: string | undefined, 
-/** [ref]②:出身归因的部署侧一半(缺席 ⇒ 归不出治理出身 ⇒ 键缺席,与 best-effort 同方向)。**位置在
- *  `pollMs` 之前**是刻意的:`pollMs` 只有测试传,而本参数是每个生产调用点都必须给的那一个。 */
-governance?: GovernancePosture, pollMs?: number): Promise<void>;
+/** [ref]②:出身归因的部署侧一半 + 三张审批名单(问的属主)。缺席 ⇒ 归不出治理出身(键缺席,与 best-effort 同方向)、没有一行读作
+ *  部署名单的问(记不住,方向是多问)。**位置在 `pollMs` 之前**是刻意的:`pollMs` 只有测试传,而本参数是每个生产调用点都必须给的那一个。 */
+governance?: PendingProjectionDeployment, pollMs?: number): Promise<void>;
 export declare const APPROVALS_ASSISTANT_ROUTES: readonly [{
     readonly id: "approvals-list";
     readonly path: "/v1/approvals";

package/dist/http/routes/approvals-assistant.js

@@ -1,8 +1,8 @@
 import { screenedGate } from "../../trace/project.js";
-import { hostDecisionFacts } from "../../host-decision.js";
+import { hostDecisionFacts, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
-import { APPROVAL_GATE_KINDS, SETTLED_BY_DENY_ONLY, SETTLED_BY_MUST_BE_STRING, SETTLED_BY_TOO_WIDE, judgeSettledByBody, standingAnswerMayRetire } from "../../tool-approval.js";
+import { APPROVAL_GATE_KINDS, carriesDeploymentListQuestion, standingAnswerDurablyRecordable } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
@@ -17,7 +17,8 @@ import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isOperator, sendPrincipalRefusal } from "../principal-gate.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
-import { answerGrantsBeyondCall } from "../../standing-answer-grant.js";
+import { deploymentListAsks } from "../../approval.js";
+import { answerGrantsBeyondCall, grantBindingOf } from "../../standing-answer-grant.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -25,10 +26,10 @@ import { readResumeCtx, resumeCtxCorruptAnswer } from "../resume-ctx-read.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 const DECIDE_BODY_DECLARED_KEYS = [
-    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decision", "reason", "remember", "settledBy", "updatedInput",
+    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decision", "reason", "remember", "updatedInput",
 ];
 const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
-const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "remember", "settledBy", "updatedInput"];
+const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "remember", "updatedInput"];
 const PLAN_REVIEW_BODY_DECLARED_KEYS = [
     "boundCallId", "decision", "editedPlan", "permissionModeAfter", "reason",
 ];
@@ -356,6 +357,9 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(s.mandate !== undefined ? { mandate: s.mandate } : {}),
                     ...(s.denialLimitFallback !== undefined ? { denialLimitFallback: s.denialLimitFallback } : {}),
                     ...(s.origin !== undefined ? { origin: s.origin } : {}),
+                    ...(s.boundGrantDigest !== undefined ? { boundGrantDigest: s.boundGrantDigest } : {}),
+                    ...(s.boundGrants !== undefined ? { boundGrants: s.boundGrants } : {}),
+                    ...(s.classifierNoRuling !== undefined ? { classifierNoRuling: s.classifierNoRuling } : {}),
                     objective,
                     input,
                 };
@@ -637,13 +641,14 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "deny" ? "deny" : undefined;
             if (!decision) {
-                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, settledBy? }");
+                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, decidedBy? }", retiredDecisionKeyFacts(body)?.extra);
                 return;
             }
             {
                 const keyIssue = decisionBodyKeyIssue("approval-decide", body);
                 if (keyIssue) {
-                    sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
+                    const retired = retiredDecisionKeyFacts(body);
+                    sendError(res, 400, "request.body_shape", retired?.error ?? keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys, ...retired?.extra });
                     return;
                 }
             }
@@ -708,29 +713,22 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "checkpoint_token_not_in_proof", "checkpointToken is not supported on a direct-door worker (not covered by the decision proof); bind the decision with boundCallId and boundInputHash instead");
                 return;
             }
-            const settledByVerdict = judgeSettledByBody(body.settledBy, decision, deps.config.directDoorActive);
-            switch (settledByVerdict.kind) {
+            const decidedByReading = readDecidedBy(body.decidedBy, deps.config.directDoorActive);
+            switch (decidedByReading.kind) {
                 case "not_in_proof":
-                    sendError(res, 400, "settled_by_not_in_proof", "settledBy is not supported on a direct-door worker (not covered by the decision proof)");
-                    return;
-                case "deny_only":
-                    sendError(res, 400, "request.field_conflict", SETTLED_BY_DENY_ONLY);
-                    return;
-                case "not_string":
-                    sendError(res, 400, "request.field_invalid", SETTLED_BY_MUST_BE_STRING);
+                    sendError(res, 400, "decided_by_not_in_proof", DECIDED_BY_NOT_IN_PROOF);
                     return;
-                case "too_wide":
-                    sendError(res, 400, "request.field_invalid", SETTLED_BY_TOO_WIDE);
+                case "outside_closed_set":
+                    sendError(res, 400, "request.field_invalid", DECIDED_BY_OUTSIDE_CLOSED_SET);
                     return;
-                case "absent":
                 case "accepted":
                     break;
                 default: {
-                    const unreachable = settledByVerdict;
-                    throw new Error(`unhandled settledBy verdict: ${JSON.stringify(unreachable)}`);
+                    const unreachable = decidedByReading;
+                    throw new Error(`unhandled decidedBy reading: ${JSON.stringify(unreachable)}`);
                 }
             }
-            const settledBy = settledByVerdict.kind === "accepted" ? settledByVerdict.settledBy : undefined;
+            const decidedBy = decidedByReading.decidedBy;
             const binding = {
                 checkpointToken: body.checkpointToken,
                 boundCallId: body.boundCallId,
@@ -779,7 +777,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };
                 }
                 : undefined;
-            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(settledBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
+            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(decidedBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
             const outErrorCode = out.body.errorCode;
             if (pendingGrant !== undefined && out.status === 200 && (outErrorCode !== "cancelled" || out.decisionCommitted === true) && deps.approvalExemptionStore) {
                 try {
@@ -823,14 +821,17 @@ function redactPendingDisclosures(row) {
     const next = redactRiskDescriptor(rd);
     return next === rd ? row : { ...row, riskDescriptor: next };
 }
-function projectPendingForWire(row, governance) {
+function projectPendingForWire(row, deployment) {
+    const governance = deployment;
     const redacted = redactPendingDisclosures(row);
     const governanceForced = governanceOriginOf({ riskDescriptor: row.riskDescriptor ?? undefined }, governance);
-    const rememberRefused = !standingAnswerMayRetire({
+    const rememberRefused = !standingAnswerDurablyRecordable({
         governanceForced: governanceForced === true,
         requiresRealApproval: row.requiresRealApproval === true,
         mandated: row.mandated === true || row.ruleOffersAbsence === "mandated",
-        grantsBeyondCall: answerGrantsBeyondCall(row),
+        grantBinding: grantBindingOf(row),
+        classes: row.classes,
+        deploymentListQuestion: carriesDeploymentListQuestion(row.toolName !== null && deployment !== undefined && deploymentListAsks(deployment, { toolName: row.toolName }), row.classes),
     });
     return { ...redacted, ...(governanceForced ? { governanceForced } : {}), ...(rememberRefused ? { rememberRefused: true } : {}) };
 }

package/dist/http/routes/capabilities.js

@@ -1,4 +1,4 @@
-import { expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
+import { PERMISSION_MODES, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
 import { modelImageInput, isModelAllowlisted, selectableCatalog } from "../../model-select.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
 import { projectSealedKeyCapability } from "../../sealed-key.js";
@@ -23,7 +23,7 @@ import { workflowModelAllowlistFor } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import * as facts from "../../capability-facts.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
-import { coercePermissionModeStrict, SETTINGS_PERMISSION_MODE_WORDS, taskHooksHonored } from "../../task-settings.js";
+import { coercePermissionModeStrict, PERMISSION_MODE_WORDS, taskHooksHonored } from "../../task-settings.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 function routePairingOf(deps, name, m) {
     if (modelKeyPoisonOf(name, deps.config.modelApiKeyEnv ?? {}, process.env, deps.config.modelApiKeys ?? {}) !== undefined)
@@ -60,7 +60,7 @@ export async function handleCapabilities(req, res, match, ctx) {
             const requestedModeRaw = new URLSearchParams(match.search).get("permissionMode");
             const requestedMode = requestedModeRaw === null ? undefined : coercePermissionModeStrict(requestedModeRaw);
             if (requestedModeRaw !== null && requestedMode === undefined) {
-                sendError(res, 400, "request.field_invalid", `permissionMode must be one of ${SETTINGS_PERMISSION_MODE_WORDS}`);
+                sendError(res, 400, "request.field_invalid", `permissionMode must be one of ${PERMISSION_MODE_WORDS}`);
                 return;
             }
             const entitlementSource = centerEntitlementSourceWired(deps.config);
@@ -137,6 +137,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 taskAgents: deps.config.requirePrincipal !== true,
                 retainBackgroundProcesses: deps.config.requirePrincipal !== true,
                 interactiveTools: true,
+                approvalReach: true,
                 disableSkills: true,
                 userInvokedSkills: true,
                 skillToolLists: true,
@@ -158,6 +159,8 @@ export async function handleCapabilities(req, res, match, ctx) {
                 approvalsStreamLive: projectApprovalsStreamLiveCapability(deps),
                 streamApproval: facts.streamApproval(deps).available,
                 approvalDecisionNote: true,
+                approvalDecidedBy: true,
+                permissionModes: [...PERMISSION_MODES],
                 sideQuery: true,
                 agentRoster: facts.agentRoster(deps).available,
                 retention: retentionAdvertisement(deps.config),

package/dist/http/routes/mcp-reconnect.d.ts

@@ -36,6 +36,23 @@
  * (`isParkedRunStatus` / `isTerminalRunStatus`)与 `runProvenElsewhere`(手抄已收编成一只谓词,S-430 起同住 `plugins/store-contracts.ts`)。
  * 显式 operator 可重拨任何租户的会话(监督动作,与 notify / steer 同臂;**不是** bare `isOperator`)。
  *
+ * ── 应答期限(S-431)────────────────────────────────────────────────────────────────────────────
+ * 修前这一口对 `live.reconnectMcpServer(server)` 是裸 `await`:server 侧没有期限,上界只来自 core 自己的启动期钟
+ * (env `MCP_TIMEOUT`,未设落 SDK 缺省 60s;拨号之前还有一次不在那条钟里的旧连接 `close()`),一台拨不通 / 半开的远端能把这一口
+ * HTTP 请求挂很久。现在与 `GET /v1/sessions/:id/mcp` 面板读**同一只**数 `MCP_DIAL_DEADLINE_MS`(`../mcp-dial-deadline.ts`),
+ * 到点答 **503 `state.mcp_reconnect_unsettled`**。
+ * 🔴 **只界应答,不取消重拨**:core 的 `TaskStream.reconnectMcpServer(server)` 不收 `AbortSignal`(d.ts 逐字:单参),
+ * 本面没有取消把手可递,也不伪造一个。到点之后重拨**继续跑**,落定时照常把名册写上这条 run(成功)或撤走(拨号失败)—— 所以
+ * 503 说的是「这一口没等到结果」,**不是**「失败」,文案与契约 §G.7c 都按这个读法写。重发**不作保证**:core 的在途守卫
+ * (`redialsInFlight`,`dist/core/mcp.js`)只罩**拨号本身**(关旧 + 连 + 列),拨号一落定就放开,而 `redialMcpServer`
+ * (`dist/core/runner/mcp-redial.js`)随后还要 `await commitMcpRosterChanges`(重建工具面)—— 那一段里守卫已不在,
+ * 此刻再发会开第二次「先关后拨」。所以文案只说「拨号还在跑时 core 会拒第二次」,不说「重发一定得 refused」,也不把重发
+ * 推荐成探针(对抗复审 [medium],验真后采纳;守卫延到名册提交之后是 core 的活,本仓不自造第二份在途判)。
+ * 为什么是 503 而不是 200 + 第四个 `outcome` 词:`outcome` 三词是 core 结果的投影,这里**没有结果**,编一个词就是替
+ * core 说话(与 `unsupported` 那一行「没有 core 结果就不铸 `prefix`」同一条纪律);503 是 `state.*` 族的唯一状态
+ * (附录 A 判据 3),与 `state.mcp_probe_incomplete` 同族同档,但**不复用**它的码 —— 那一码的语义钉在 probe 面上。
+ * 本面**不**带 `Retry-After`:重发不是无代价的重试(见上),一个会被通用重试臂自动执行的头在一次交易动词上是错的方向。
+ *
  * ── 计费/门 ─────────────────────────────────────────────────────────────────────────────────────
  * 零模型工作(不进 billable;不吃 drain / roster-pending);mutating ⇒ `rateLimited`。能力位 `mcpReconnect`
  * = 持久 run 账面 ∧ 会话属主面(两道 501 的同一批 deps 推导出来,「说 yes 但 501」结构上不可能)。

package/dist/http/routes/mcp-reconnect.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { redactSecrets } from "../../trace/redact.js";
+import { DeadlineExceeded, MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import {} from "../route-ctx.js";
@@ -99,11 +100,15 @@ export async function handleMcpReconnect(req, res, match, ctx) {
             const live = activeTaskId === undefined ? undefined : ctx.registry.steerableRuns.get(activeTaskId);
             if (live) {
                 try {
-                    const result = await live.reconnectMcpServer(server);
+                    const result = await raceDeadline(live.reconnectMcpServer(server), MCP_DIAL_DEADLINE_MS);
                     sendJson(res, 200, { taskId: activeTaskId, sessionId, ...projectResult(result) });
                     return;
                 }
                 catch (e) {
+                    if (e instanceof DeadlineExceeded) {
+                        sendError(res, 503, "state.mcp_reconnect_unsettled", "the MCP re-dial did not settle within the time this endpoint waits, so there is no outcome to report — the re-dial itself was NOT cancelled (the engine takes no cancellation for it) and may still finish, so do not assume it failed; do not resend blindly either: the engine refuses a second re-dial of the same server only while the dial itself is still running, and a request sent after that point starts another close-then-dial on a server that may now be healthy, so check the server's state before re-sending");
+                        return;
+                    }
                     const code = e.code;
                     const msg = e instanceof Error ? e.message : String(e);
                     switch (code) {

package/dist/http/routes/memory-bundle.js

@@ -37,7 +37,7 @@ function sentClassifiedFailure(res, ctx, face, err) {
     const code = codeOf(err);
     if (code !== undefined && sentCoreCode(res, code, err instanceof Error ? err.message : String(err)))
         return true;
-    if (sentMemoryStoreRefusal(res, err))
+    if (sentMemoryStoreRefusal(res, err, ctx.deps.logger))
         return true;
     ctx.deps.logger?.warn?.(`memory_bundle_${face}_failed`, { err: String(err) });
     return false;

package/dist/http/routes/memory-compliance.js

@@ -12,7 +12,7 @@ const EraseRequestSchema = z.object({
     allowUnevidenced: z.boolean().optional(),
 });
 function sentClassifiedFailure(res, ctx, face, err) {
-    if (sentMemoryComplianceFailure(res, err, { kind: "operator" }))
+    if (sentMemoryComplianceFailure(res, err, { kind: "operator" }, ctx.deps.logger))
         return true;
     ctx.deps.logger?.warn?.(`memory_compliance_${face}_failed`, { err: String(err) });
     return false;

package/dist/http/routes/memory-origin.d.ts

@@ -114,7 +114,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     baseRev: string;
     origin: {
         at: number;
-        cause?: "static" | "observed" | "unattributed" | "derived" | undefined;
+        cause?: "static" | "unattributed" | "observed" | "derived" | undefined;
         taint: "external";
     };
 };

package/dist/http/routes/memory-origin.js

@@ -54,7 +54,7 @@ function sentClassifiedFailure(res, ctx, face, err) {
         if (coreCode !== undefined && sentClearCode(res, coreCode, err instanceof Error ? err.message : String(err)))
             return true;
     }
-    if (face !== "clearances" && sentMemoryStoreRefusal(res, err))
+    if (face !== "clearances" && sentMemoryStoreRefusal(res, err, ctx.deps.logger))
         return true;
     if (err instanceof ControlPlaneCorruptError) {
         sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);

package/dist/http/routes/runs.js

@@ -1,7 +1,7 @@
 import { persistedPlaneOf } from "../../terminal.js";
 import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventForRead, redactTerminalResult } from "../../observability/run-terminal.js";
 import { z } from "zod";
-import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS } from "@sema-agent/core";
+import { uuidv7, mintCheckpointToken, CheckpointError, policyCannotAnswer, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS, isSystemInjectionPriority } from "@sema-agent/core";
 import { RUN_HOLDER_DEATH_CODES, isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-sql.js";
 import { redactSecrets } from "../../trace/redact.js";
@@ -14,13 +14,16 @@ import { createHash } from "node:crypto";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { streamSseLog } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
-import { buildApprovalPreamble, buildApprovalPreambleSseFrames } from "../../approval-card.js";
-import { ASK_DECISION_CONSUMER_ABSENT, SETTLED_BY_DENY_ONLY, SETTLED_BY_MUST_BE_STRING, SETTLED_BY_TOO_WIDE, judgeSettledByBody, outcomeOfDecidedRow, resolveStreamApprovalGate, respondSettledBy } from "../../tool-approval.js";
+import { buildApprovalPreamble, buildApprovalPreambleSseFrames, readClosedWordSeat, storedCardDemandsAPerson } from "../../approval-card.js";
+import { heldAskOf, liveSettledBy, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "../../host-decision.js";
+import { ASK_DECISION_CONSUMER_ABSENT, outcomeOfDecidedRow, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { MAX_DECISION_NOTE_CHARS } from "../../approval-ask-machine.js";
 import { normalizeRunEventType, screenedStoredEventData } from "../../trace/project.js";
 import { sendJson, sendError, httpErrorCode, sseHeaders } from "../send.js";
 import { readTurnActivityMs } from "../../turn-activity.js";
 import { mintCancelledResult } from "../../run-cancel-context.js";
+import { acceptedInputKindOf } from "../../user-input-ledger.js";
+import { INJECTION_TIERS } from "../../trace/injection-tier.js";
 import { buildCrossSliceUsage, readResourceWindow } from "../../resource-window.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { ActorAssertionWire } from "@sema-agent/settings-schema";
@@ -31,6 +34,9 @@ import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { readResumeCtx } from "../resume-ctx-read.js";
 import { storedBodyReplayAnswer, storedBodyReplayLogFields, storedBodyReplayRefusal } from "../checkpoint-ctx.js";
+const STEER_PRIORITY_WORDS = INJECTION_TIERS.map((tier) => `'${tier}'`);
+const STEER_PRIORITY_UNION = STEER_PRIORITY_WORDS.join(" | ");
+const STEER_PRIORITY_CHOICES = STEER_PRIORITY_WORDS.length <= 2 ? STEER_PRIORITY_WORDS.join(" or ") : `${STEER_PRIORITY_WORDS.slice(0, -1).join(", ")}, or ${STEER_PRIORITY_WORDS[STEER_PRIORITY_WORDS.length - 1]}`;
 const ASK_PARKING_RETRY_AFTER_SEC = 2;
 const ASK_ACTOR_LABEL_MAX = 256;
 const AskDecisionActorSchema = ActorAssertionWire.strip();
@@ -46,7 +52,7 @@ const AskDecisionBodySchema = z
         .refine((k) => k.trim() === k, { message: "idempotency key must not have leading/trailing whitespace" })
         .optional(),
     actor: z.object({ label: z.string().max(ASK_ACTOR_LABEL_MAX) }).strict().optional(),
-    settledBy: z.unknown().optional(),
+    decidedBy: z.unknown().optional(),
 })
     .strict();
 const ASK_DECISION_CONFIRM_TIMEOUT_MS = 2_000;
@@ -136,11 +142,17 @@ async function streamRunEvents(req, res, deps, runStore, taskId, staleMs) {
         staleFrame: () => ({ event: "failed", data: { type: "failed", errorMessage: "run stalled (instance lost?)" } }),
     }, taskId, staleMs);
 }
+function sendSteerReplayRefusal(res, refusal) {
+    const detail = refusal?.detail;
+    const differs = detail !== null && typeof detail === "object" ? readClosedWordSeat(detail, "differs") : undefined;
+    sendError(res, 409, "steering.duplicate_input_id", refusal instanceof Error ? refusal.message : "this steering input id was already accepted with different values", differs !== undefined ? { detail: { differs } } : undefined);
+}
 async function acceptLiveUserInput(deps, res, at) {
     if (!deps.userInputLedger)
         return undefined;
+    const input = acceptedInputKindOf(at.tier);
     try {
-        return await deps.userInputLedger.accept({ input: "steer", messageId: at.messageId, sessionId: at.sessionId, taskId: at.taskId, leg: at.leg });
+        return await deps.userInputLedger.accept({ input, messageId: at.messageId, sessionId: at.sessionId, taskId: at.taskId, leg: at.leg });
     }
     catch (e) {
         deps.logger?.warn?.("user_input_ledger_accept_failed", { taskId: at.taskId, sessionId: at.sessionId, err: e instanceof Error ? e.message : String(e) });
@@ -429,15 +441,15 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         if (typeof body.text !== "string" || body.text.length === 0) {
-            sendError(res, 400, "request.body_shape", "body must be { text: string (non-empty), mode?: 'all' | 'one-at-a-time', priority?: 'now' | 'next' | 'later' }");
+            sendError(res, 400, "request.body_shape", `body must be { text: string (non-empty), mode?: 'all' | 'one-at-a-time', priority?: ${STEER_PRIORITY_UNION} }`);
             return;
         }
         if (body.mode !== undefined && body.mode !== "all" && body.mode !== "one-at-a-time") {
             sendError(res, 400, "request.field_invalid", "mode must be 'all' or 'one-at-a-time' when present");
             return;
         }
-        if (body.priority !== undefined && body.priority !== "now" && body.priority !== "next" && body.priority !== "later") {
-            sendError(res, 400, "request.field_invalid", "priority must be 'now', 'next', or 'later' when present");
+        if (body.priority !== undefined && !isSystemInjectionPriority(body.priority)) {
+            sendError(res, 400, "request.field_invalid", `priority must be ${STEER_PRIORITY_CHOICES} when present`);
             return;
         }
         const text = body.text;
@@ -495,19 +507,19 @@ export async function handleRuns(req, res, match, ctx) {
                     return "queue-full";
                 }
                 if (e instanceof CheckpointError && e.code === "steering.duplicate_input_id") {
-                    parkDuplicateKey = e.message;
+                    parkDuplicateKey = e;
                     return "duplicate-key";
                 }
                 throw e;
             }
         };
         const sendQueueFull = () => sendError(res, 409, "steering.queue_full", parkQueueFull ?? "the parked steering queue on this checkpoint is full");
-        const sendDuplicateKey = () => sendError(res, 409, "steering.duplicate_input_id", parkDuplicateKey ?? "this Idempotency-Key is already parked with different steering content — reissue with a fresh key");
+        const sendDuplicateKey = () => sendSteerReplayRefusal(res, parkDuplicateKey);
         const sendParked = (status) => sendJson(res, 202, { taskId, status, delivery: "queued", messageId, ...(priority ? { priority } : {}), note: "steer parked on the checkpoint — injected when the run resumes" });
         const sendNotRunning = (error) => sendError(res, 409, "steering.not_running", error);
         const live = steerableRuns.get(taskId);
         if (live) {
-            const acceptance = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId, leg: live });
+            const acceptance = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId, leg: live, tier: priority });
             if (acceptance === "refused")
                 return;
             try {
@@ -526,7 +538,7 @@ export async function handleRuns(req, res, match, ctx) {
                     return;
                 }
                 if (code === "steering.duplicate_input_id") {
-                    parkDuplicateKey = e instanceof Error ? e.message : undefined;
+                    parkDuplicateKey = e;
                     sendDuplicateKey();
                     return;
                 }
@@ -601,7 +613,7 @@ export async function handleRuns(req, res, match, ctx) {
                         return;
                     }
                     if (e instanceof CheckpointError && e.code === "steering.duplicate_input_id") {
-                        parkDuplicateKey = e.message;
+                        parkDuplicateKey = e;
                         mintResult.duplicateKey = true;
                         return;
                     }
@@ -831,7 +843,7 @@ export async function handleRuns(req, res, match, ctx) {
             });
             return;
         }
-        const acceptance = await acceptLiveUserInput(deps, res, { messageId: interruptMessageId, sessionId: run.sessionId, taskId, leg: liveStream });
+        const acceptance = await acceptLiveUserInput(deps, res, { messageId: interruptMessageId, sessionId: run.sessionId, taskId, leg: liveStream, tier: "now" });
         if (acceptance === "refused")
             return;
         try {
@@ -848,7 +860,7 @@ export async function handleRuns(req, res, match, ctx) {
                 return;
             }
             if (code === "steering.duplicate_input_id") {
-                sendError(res, 409, "steering.duplicate_input_id", e instanceof Error ? e.message : "this Idempotency-Key was already accepted with different content or at a different tier — reissue with a fresh key");
+                sendSteerReplayRefusal(res, e);
                 return;
             }
             if (code !== "steering.not_running")
@@ -1221,7 +1233,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
                     return;
                 }
                 const messageId = uuidv7();
-                const acceptance = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId: runId, leg: handle });
+                const acceptance = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId: runId, leg: handle, tier: undefined });
                 if (acceptance === "refused")
                     return;
                 const marker = await relayAcceptedInput(deps, acceptance, () => handle.steer(redacted));
@@ -1361,33 +1373,31 @@ export async function handleRunVerbs(req, res, match, ctx) {
         }
         const parsedBody = AskDecisionBodySchema.safeParse(rawBody);
         if (!parsedBody.success) {
-            sendError(res, 400, "request.body_shape", "invalid ask decision body — expected decision=approve|deny plus optional updatedInput / note / idempotencyKey / actor.label / settledBy");
+            const retired = retiredDecisionKeyFacts(rawBody);
+            if (retired !== undefined) {
+                sendError(res, 400, "request.body_shape", retired.error, retired.extra);
+                return;
+            }
+            sendError(res, 400, "request.body_shape", "invalid ask decision body — expected decision=approve|deny plus optional updatedInput / note / idempotencyKey / actor.label / decidedBy");
             return;
         }
         const body = parsedBody.data;
-        const settledByVerdict = judgeSettledByBody(body.settledBy, body.decision, deps.config.directDoorActive);
-        switch (settledByVerdict.kind) {
+        const decidedByReading = readDecidedBy(body.decidedBy, deps.config.directDoorActive);
+        switch (decidedByReading.kind) {
             case "not_in_proof":
-                sendError(res, 400, "settled_by_not_in_proof", "settledBy is not supported on a direct-door worker (not covered by the decision proof)");
-                return;
-            case "deny_only":
-                sendError(res, 400, "request.field_conflict", SETTLED_BY_DENY_ONLY);
+                sendError(res, 400, "decided_by_not_in_proof", DECIDED_BY_NOT_IN_PROOF);
                 return;
-            case "not_string":
-                sendError(res, 400, "request.field_invalid", SETTLED_BY_MUST_BE_STRING);
+            case "outside_closed_set":
+                sendError(res, 400, "request.field_invalid", DECIDED_BY_OUTSIDE_CLOSED_SET);
                 return;
-            case "too_wide":
-                sendError(res, 400, "request.field_invalid", SETTLED_BY_TOO_WIDE);
-                return;
-            case "absent":
             case "accepted":
                 break;
             default: {
-                const unreachable = settledByVerdict;
-                throw new Error(`unhandled settledBy verdict: ${JSON.stringify(unreachable)}`);
+                const unreachable = decidedByReading;
+                throw new Error(`unhandled decidedBy reading: ${JSON.stringify(unreachable)}`);
             }
         }
-        const settledBy = settledByVerdict.kind === "accepted" ? settledByVerdict.settledBy : undefined;
+        const decidedBy = decidedByReading.decidedBy;
         const hasUpdatedInput = typeof rawBody === "object" && rawBody !== null && "updatedInput" in rawBody;
         const taskId = match.params.taskId;
         const askId = match.params.askId;
@@ -1513,6 +1523,10 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendTerminal(row0);
             return;
         }
+        if (body.decision === "approve" && policyCannotAnswer(heldAskOf(storedCardDemandsAPerson(row0.cardJson)), decidedBy)) {
+            sendError(res, 400, "request.field_conflict", POLICY_CANNOT_ALLOW_PERSON_ASK);
+            return;
+        }
         let outcome;
         const releaseEditMark = body.decision === "approve" && hasUpdatedInput ? deps.toolApproval?.markEditedDecisionInFlight(askId) : undefined;
         try {
@@ -1521,7 +1535,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
                 decisionActor: actor,
                 decisionNote: body.note ?? null,
                 idempotencyKey: body.idempotencyKey ?? null,
-                ...(settledBy !== undefined ? { settledBy: respondSettledBy({ settledBy }) } : {}),
+                ...((sb) => (sb !== undefined ? { settledBy: sb } : {}))(liveSettledBy(decidedBy)),
                 ...(body.decision === "approve" && hasUpdatedInput ? { updatedInput: body.updatedInput } : {}),
             });
         }

package/dist/http/routes/sessions.d.ts

@@ -6,7 +6,7 @@
  *
  * 单域独占状态(lens1 §C2 的 12 条里的 5 条)全部收进 `SessionsLocal`,每个 server 实例一份:
  * SSE 连接坑计数 `sseConnections`、owner 查探许可 `sseOwnerLookups`、`/mcp` 面板的短 TTL single-flight
- * 缓存 `mcpStatusCache` 与它的两个时限常量。
+ * 缓存 `mcpStatusCache` 与它的时限常量(应答期限 `MCP_DIAL_DEADLINE_MS` 与 `POST …/mcp/reconnect` 共读,见 `../mcp-dial-deadline.ts`)。
  *
  * ⚠️ 搬运例外(仅此一处,语义等价):两个原为闭包 `let` 的计数器进了 local 盒子,于是 6 个使用点写成
  * `sse.sseConnections` / `sse.sseOwnerLookups`——`let` 无法跨模块共享自增。判据/时机/配对释放逐字未动。