@sema-agent/server 7.118.0 → 7.120.0

package/dist/tool-approval.js

@@ -1,7 +1,7 @@
 import { contentKindOf } from "./approval-content-kind.js";
-import { liveSettledBy, policyCannotAllow, readDecidedBy, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK, SETTLED_BY_RETIRED } from "./host-decision.js";
+import { heldAskOf, liveSettledBy, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "./host-decision.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, classifyAsk, foldArbitrationRow, screenAskClassMembers, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
+import { uuidv7, classifyAsk, foldArbitrationRow, policyCannotAnswer, screenAskClassMembers, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
 import { redactDeep, redactSecrets, redactSecretsWithArms } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -15,6 +15,8 @@ import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 import { governanceOriginOf } from "./runtime-governance.js";
 import { answerGrantsBeyondCall, grantBindingOf } from "./standing-answer-grant.js";
+import { operatorAsk } from "./operator-ask.js";
+import { APPROVAL_EXEMPTED_EVENT } from "./plugins/approval-exemption-store.js";
 const defaultLogger = createLogger();
 export const APPROVAL_GATE_KINDS = ["human", "irreversible_ask"];
 export function isApprovalGateKind(k) {
@@ -54,7 +56,7 @@ function durableRuleMaterial(material) {
 export const ASK_DECISION_CONSUMER_ABSENT = "absent";
 const MAX_INFLIGHT_TERMINAL_CLAIMS = 2;
 const DURABLE_CONVERGE_BACKOFF_MS = [50, 100, 200, 400, 800, 1600];
-const DURABLE_CONVERGE_READ_TIMEOUT_MS = 2_000;
+export const DURABLE_CONVERGE_READ_TIMEOUT_MS = 2_000;
 const DURABLE_CALL_TIMEOUT_MS = 5_000;
 const TERMINAL_LADDER_WALL_MS = DURABLE_CALL_TIMEOUT_MS + DURABLE_CONVERGE_READ_TIMEOUT_MS + DURABLE_CONVERGE_BACKOFF_MS.reduce((a, b) => a + b, 0);
 const TERMINAL_CLAIM_CAP_POLL_MS = 50;
@@ -85,43 +87,65 @@ function sessionAllowCategory(toolName) {
 function sessionAllowKey(owner, sessionId, category, binding) {
     return JSON.stringify([owner, sessionId, category, binding.kind === "bound" ? binding.digest : null]);
 }
-function askStandingAnswerFacts(req, governanceForced) {
+function askStandingAnswerFacts(req, governanceForced, deploymentListAsks) {
+    const classes = screenAskClassMembers(req.askClass, req.classes)?.classes;
     return {
         governanceForced,
         requiresRealApproval: req.requiresRealApproval === true,
         mandated: req.mandated === true,
         grantBinding: grantBindingOf(req),
-        classes: screenAskClassMembers(req.askClass, req.classes)?.classes,
+        classes,
+        deploymentListQuestion: carriesDeploymentListQuestion(deploymentListAsks, classes),
     };
 }
-export function policyAskStandingAnswerFacts(req, ask) {
+const NO_GATE_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} };
+const DEPLOYMENT_LIST_ASK_CLASSES = new Set(classifyAsk(operatorAsk("APPROVAL_REQUIRE", ""), NO_GATE_FACTS).classes);
+export function carriesDeploymentListQuestion(deploymentListAsks, classes) {
+    return deploymentListAsks && classes !== undefined && classes.some((c) => DEPLOYMENT_LIST_ASK_CLASSES.has(c));
+}
+export function policyAskStandingAnswerFacts(req, ask, deploymentListQuestion) {
     return {
         governanceForced: false,
         requiresRealApproval: ask.requiresRealApproval === true,
         mandated: ask.mandated === true,
         grantBinding: grantBindingOf(req),
-        classes: [...classifyAsk(ask, { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} }).classes],
+        classes: [...classifyAsk(ask, NO_GATE_FACTS).classes],
+        deploymentListQuestion,
     };
 }
-export function standingAnswerMayRetire(facts) {
-    return (!facts.governanceForced &&
-        !facts.requiresRealApproval &&
-        !facts.mandated &&
-        facts.grantBinding.kind !== "unreadable" &&
-        facts.classes !== undefined &&
-        foldArbitrationRow(new Set(facts.classes)).ruleMayClear);
+export function standingAnswerHome(facts) {
+    if (facts.governanceForced || facts.requiresRealApproval || facts.mandated || facts.classes === undefined)
+        return "none";
+    if (facts.deploymentListQuestion) {
+        return facts.grantBinding.kind === "none" && facts.classes.every((c) => DEPLOYMENT_LIST_ASK_CLASSES.has(c)) ? "server_store" : "none";
+    }
+    return facts.grantBinding.kind !== "unreadable" && foldArbitrationRow(new Set(facts.classes)).ruleMayClear ? "seat" : "none";
 }
 export function standingAnswerDurablyRecordable(facts) {
-    return standingAnswerMayRetire(facts) && facts.grantBinding.kind === "none";
+    const home = standingAnswerHome(facts);
+    switch (home) {
+        case "none":
+            return false;
+        case "seat":
+            return facts.grantBinding.kind === "none";
+        case "server_store":
+            return true;
+        default: {
+            const unhandled = home;
+            throw new Error(`unhandled standing-answer home: ${String(unhandled)}`);
+        }
+    }
 }
-export function parkRowStandingAnswerFacts(pending, gate, governance) {
+export function parkRowStandingAnswerFacts(pending, gate, governance, deploymentListAsks) {
     const riskDescriptor = "riskDescriptor" in gate ? gate.riskDescriptor : undefined;
+    const classes = screenAskClassMembers(pending.askClass, pending.classes)?.classes;
     return {
         governanceForced: governanceOriginOf({ riskDescriptor }, governance) === true,
         requiresRealApproval: readParkRowTrueSeat(pending, "requiresRealApproval"),
         mandated: readParkRowTrueSeat(pending, "mandated") || mandatedFromSeat(readRuleOffersAbsenceSeat(pending)),
         grantBinding: grantBindingOf(pending),
-        classes: screenAskClassMembers(pending.askClass, pending.classes)?.classes,
+        classes,
+        deploymentListQuestion: carriesDeploymentListQuestion(deploymentListAsks, classes),
     };
 }
 function pendingEntryStandingAnswerFacts(entry) {
@@ -131,6 +155,7 @@ function pendingEntryStandingAnswerFacts(entry) {
         mandated: entry.mandated === true,
         grantBinding: entry.grantBinding,
         classes: entry.classes,
+        deploymentListQuestion: entry.deploymentListQuestion === true,
     };
 }
 function mandatedFromSeat(seat) {
@@ -151,6 +176,11 @@ export const READ_ROOT_GRANT_ALLOW_ONLY = 'readRootGrant is only meaningful with
 export const READ_ROOT_GRANT_SHAPE = `readRootGrant must be the card's readRootCandidate.dir sent back byte for byte — a non-empty string of at most ${READ_ROOT_CANDIDATE_DIR_MAX} characters`;
 export const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope — the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
 export function parseToolApprovalResponse(body) {
+    const retired = retiredDecisionKeyFacts(body);
+    const parsed = parseToolApprovalFields(body, retired);
+    return parsed.ok || retired === undefined ? parsed : { ...parsed, ...retired.extra };
+}
+function parseToolApprovalFields(body, retired) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
         return { ok: false, error: "body must be an object" };
     const d = body.decision;
@@ -193,8 +223,8 @@ export function parseToolApprovalResponse(body) {
             }
             note = rawNote;
         }
-        if (body.settledBy !== undefined)
-            return { ok: false, error: SETTLED_BY_RETIRED };
+        if (retired !== undefined)
+            return { ok: false, error: retired.error };
         const decidedByReading = readDecidedBy(body.decidedBy, false);
         let decidedBy;
         switch (decidedByReading.kind) {
@@ -386,6 +416,7 @@ export class ToolApprovalCoordinator {
     parkedRedeem;
     askAudit;
     sessionGrants;
+    deploymentListAsks;
     shutdownDraining = false;
     asksInFlight = 0;
     parkCommits;
@@ -407,6 +438,10 @@ export class ToolApprovalCoordinator {
         this.parkTombstonePerPrincipalMax = opts?.parkTombstonePerPrincipalMax ?? DEFAULT_PARK_TOMBSTONE_PER_PRINCIPAL_MAX;
         this.askAudit = opts?.askAudit;
         this.sessionGrants = opts?.sessionGrants;
+        if (opts?.deploymentListAsks !== undefined && opts.sessionGrants === undefined) {
+            throw new Error("ToolApprovalCoordinator: deploymentListAsks needs sessionGrants — the deployment list's standing answers live in the session exemption store");
+        }
+        this.deploymentListAsks = opts?.deploymentListAsks;
         this.parkCommits = opts?.parkCommits;
         this.parkCommits?.onParkCommitted((calls) => this.noteParkCommitted(calls));
     }
@@ -758,9 +793,19 @@ export class ToolApprovalCoordinator {
         return (this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(origin.owner, origin.sessionId, origin.taskId))).isMarked(req.toolCallId);
     }
     async standingGrantSettles(origin, req, governanceForced) {
-        const facts = askStandingAnswerFacts(req, governanceForced);
-        if (!standingAnswerMayRetire(facts))
-            return false;
+        const facts = askStandingAnswerFacts(req, governanceForced, this.deploymentListAsks?.(req) === true);
+        const home = standingAnswerHome(facts);
+        switch (home) {
+            case "seat":
+                break;
+            case "none":
+            case "server_store":
+                return false;
+            default: {
+                const unhandled = home;
+                throw new Error(`unhandled standing-answer home: ${String(unhandled)}`);
+            }
+        }
         const sessionId = origin.sessionId;
         if (!sessionId)
             return false;
@@ -771,7 +816,7 @@ export class ToolApprovalCoordinator {
         if (!(await this.sessionGrantUncontestedByRow(origin, req)))
             return false;
         if (durable)
-            defaultLogger.info("approval_exempted", { sessionId, toolName: req.toolName, seat: "approval_seat" });
+            defaultLogger.info(APPROVAL_EXEMPTED_EVENT, { sessionId, toolName: req.toolName, seat: "approval_seat" });
         return true;
     }
     async durableGrantHas(sessionId, canonicalToolName) {
@@ -1052,6 +1097,7 @@ export class ToolApprovalCoordinator {
         if (signal?.aborted)
             return false;
         const governanceForced = this.governanceForcedOf(origin, req);
+        const deploymentListAsks = this.deploymentListAsks?.(req) === true;
         if (await this.standingGrantSettles(origin, req, governanceForced))
             return true;
         const aliveCtxs = ctxs.filter((c) => !c.abortSignal?.aborted);
@@ -1107,7 +1153,7 @@ export class ToolApprovalCoordinator {
             ...(governanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(req.mandated === true ? { mandated: true } : {}),
-            ...(standingAnswerMayRetire(askStandingAnswerFacts(req, governanceForced)) ? {} : { rememberRefused: true }),
+            ...(standingAnswerHome(askStandingAnswerFacts(req, governanceForced, deploymentListAsks)) === "none" ? { rememberRefused: true } : {}),
             ...(typeof req.boundGrantDigest === "string" ? { boundGrantDigest: req.boundGrantDigest, ...(req.boundGrants !== undefined ? { boundGrants: req.boundGrants } : {}) } : {}),
             ...(noRulingCause !== undefined ? { classifierNoRuling: noRulingCause } : {}),
             ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
@@ -1637,13 +1683,15 @@ export class ToolApprovalCoordinator {
         }
         const entryGrantBinding = grantBindingOf(req);
         const entryClasses = askClassPair?.classes;
-        const rememberRefused = !standingAnswerMayRetire(pendingEntryStandingAnswerFacts({
+        const entryDeploymentListQuestion = carriesDeploymentListQuestion(deploymentListAsks, entryClasses);
+        const rememberRefused = standingAnswerHome(pendingEntryStandingAnswerFacts({
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(req.mandated === true ? { mandated: true } : {}),
             grantBinding: entryGrantBinding,
             classes: entryClasses,
-        }));
+            ...(entryDeploymentListQuestion ? { deploymentListQuestion: true } : {}),
+        })) === "none";
         if (rememberRefused)
             frame.rememberRefused = true;
         else
@@ -1665,6 +1713,7 @@ export class ToolApprovalCoordinator {
             toolName: req.toolName,
             grantBinding: entryGrantBinding,
             ...(entryClasses !== undefined ? { classes: entryClasses } : {}),
+            ...(entryDeploymentListQuestion ? { deploymentListQuestion: true } : {}),
             registeredAtMs: Date.now(),
             expiresAtMs: persistedExpiresAtMs,
             ...(ruleLaneMaterial !== undefined ? { ruleLane: ruleLaneMaterial } : {}),
@@ -1794,7 +1843,7 @@ export class ToolApprovalCoordinator {
     respond(id, principal, body, httpReq) {
         const parsed = parseToolApprovalResponse(body);
         if (!parsed.ok)
-            return { status: 400, body: { error: parsed.error, errorCode: "request.body_shape" } };
+            return { status: 400, body: { error: parsed.error, errorCode: "request.body_shape", ...(parsed.field !== undefined ? { field: parsed.field } : {}) } };
         const entry = this.pending.get(id);
         if (!entry || (entry.owner !== null && entry.owner !== principal)) {
             return this.respondLate(id, principal, parsed, httpReq);
@@ -1802,17 +1851,43 @@ export class ToolApprovalCoordinator {
         const preRule = this.precheckEditedRuleBeforeDecision(entry, parsed);
         if (preRule !== undefined)
             return preRule;
-        if (policyCannotAllow(parsed.decidedBy, parsed.value !== "deny", entry.requiresRealApproval === true)) {
+        if (parsed.value !== "deny" && policyCannotAnswer(heldAskOf(entry.requiresRealApproval === true), parsed.decidedBy)) {
             return { status: 400, body: { error: POLICY_CANNOT_ALLOW_PERSON_ASK, errorCode: "request.body_shape" } };
         }
         const ruleEligibility = { eligible: true };
-        const settled = this.askStore && entry.askId !== undefined && entry.batchId !== undefined
+        const decided = this.askStore && entry.askId !== undefined && entry.batchId !== undefined
             ? this.respondWithCas(this.askStore, entry.askId, entry.batchId, id, entry, parsed, ruleEligibility)
             : this.finishRespond(id, entry, parsed);
+        const settled = this.recordDeploymentListAnswer(decided, entry, parsed, principal, ruleEligibility);
         if (parsed.persistRule === undefined)
             return settled;
         return this.persistRuleAfterDecision(settled, entry, parsed.persistRule, parsed.updatedInput !== undefined, ruleEligibility);
     }
+    recordDeploymentListAnswer(decided, entry, parsed, principal, eligibility) {
+        const store = this.sessionGrants;
+        const sessionId = entry.sessionId;
+        if (parsed.value !== "allow_session" || !sessionId || store === undefined)
+            return decided;
+        if (standingAnswerHome(pendingEntryStandingAnswerFacts(entry)) !== "server_store")
+            return decided;
+        return (async () => {
+            const result = await decided;
+            if (result.status !== 200)
+                return result;
+            if (!eligibility.eligible)
+                return { ...result, body: { ...result.body, rememberApplied: false } };
+            let rememberApplied = false;
+            try {
+                await this.withStoreDeadline(store.grant(sessionId, entry.toolName, principal ?? entry.owner), "sessionGrants.grant(deployment-list)", DURABLE_CALL_TIMEOUT_MS);
+                rememberApplied = true;
+                defaultLogger.info("approval_exemption_granted", { sessionId, toolName: entry.toolName, grantedBy: principal ?? entry.owner });
+            }
+            catch (err) {
+                defaultLogger.warn("approval_exemption_grant_failed", { sessionId, toolName: entry.toolName, error: String(err).slice(0, 200) });
+            }
+            return { ...result, body: { ...result.body, rememberApplied } };
+        })();
+    }
     precheckEditedRuleBeforeDecision(entry, parsed) {
         const persistRule = parsed.persistRule;
         if (persistRule === undefined || persistRule.kind !== "text" || !persistRule.edited)
@@ -2255,7 +2330,21 @@ export class ToolApprovalCoordinator {
     }
     finishRespond(id, entry, parsed, opts) {
         let rememberApplied;
-        const grantable = standingAnswerMayRetire(pendingEntryStandingAnswerFacts(entry));
+        const home = standingAnswerHome(pendingEntryStandingAnswerFacts(entry));
+        let grantable;
+        switch (home) {
+            case "seat":
+                grantable = true;
+                break;
+            case "none":
+            case "server_store":
+                grantable = false;
+                break;
+            default: {
+                const unhandled = home;
+                throw new Error(`unhandled standing-answer home: ${String(unhandled)}`);
+            }
+        }
         if (parsed.value === "allow_session")
             rememberApplied = Boolean(entry.sessionId) && grantable;
         if (parsed.value === "allow_session" && entry.sessionId && grantable) {
@@ -2299,7 +2388,7 @@ export class ToolApprovalCoordinator {
                 ...(e.requiresRealApproval ? { requiresRealApproval: true } : {}),
                 ...(e.governanceForced ? { governanceForced: true } : {}),
                 ...(e.mandated ? { mandated: true } : {}),
-                ...(standingAnswerMayRetire(pendingEntryStandingAnswerFacts(e)) ? {} : { rememberRefused: true }),
+                ...(standingAnswerHome(pendingEntryStandingAnswerFacts(e)) === "none" ? { rememberRefused: true } : {}),
                 ...(e.mandate !== undefined ? { mandate: e.mandate } : {}),
                 ...(e.origin !== undefined ? { origin: e.origin } : {}),
                 ...(e.originTaskId !== undefined ? { fromSubagent: true, originTaskId: e.originTaskId } : {}),

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;
@@ -63,10 +63,12 @@ export interface EngineNoticeWireRow {
  */
 export declare function sanitizeNoticeDetail(detail: Record<string, unknown> | undefined): Record<string, unknown>;
 /**
- * 通告 `detail` 里的**规则条目原串**过呈现口(`presentRuleEntry`:剥 C0 / 双向控制符、超长截断)—— 会话流行(经 {@link engineNoticeEventData})
- * 与运维日志行(`boot/runner-deps.ts` 的转发席)同调这一只。其余字段、其余码原样(多行文本不受影响)。
+ * 通告 `detail` 里的**规则文本**换成条目的脱敏原值({@link redactListEntry}:凭据换记号,不加引号、不转义 —— 机读位不是显示面,显示形只属于人读句)。
+ * 会话流行(经 {@link engineNoticeEventData},之后照常过 {@link sanitizeNoticeDetail})与运维日志行(`boot/runner-deps.ts` 的转发席,其余字段逐字)
+ * 同调这一只 ⇒ 两条出路上同一条规则文本逐字节同(会话流行另有 detail 串的 {@link NOTICE_TEXT_MAX} 字上限,超长的那一截只在日志行上),两只码里同一条
+ * 规则文本也同(引擎交来的两形本身一致时 —— `rule_row_dropped` 交的是引擎中和过的形,空白 / 超长的条目两只码今天不同,上游缝)。其余字段、其余码原样。
  */
-export declare function presentNoticeDetail(code: string, detail: Record<string, unknown> | undefined): Record<string, unknown> | undefined;
+export declare function redactNoticeRuleText(code: string, detail: Record<string, unknown> | undefined): Record<string, unknown> | undefined;
 export declare function engineNoticeEventData(notice: {
     code: string;
     message: string;

package/dist/trace/engine-notice-wire.js

@@ -1,5 +1,5 @@
 import { redactSecrets } from "./redact.js";
-import { presentRuleEntry } from "../rule-entry-list.js";
+import { redactListEntry } from "../list-entry-display.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 export const ENGINE_NOTICE_WIRE_CODES = [
     "memory.session_polluted",
@@ -34,6 +34,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "permission.ask_released_by_mode",
     "permission.read_deny_unapplied",
     "permission.rule_store_unavailable",
+    "permission.rule_row_dropped",
     "permission.allowed_tool_not_granted",
     "task.tool_turn_incomplete",
 ];
@@ -92,22 +93,28 @@ function sanitizeValue(v, depth) {
     }
     return undefined;
 }
-const RULE_ENTRY_DETAIL_ARRAYS = { "permission.allowed_tool_not_granted": "entries" };
-export function presentNoticeDetail(code, detail) {
-    const key = Object.hasOwn(RULE_ENTRY_DETAIL_ARRAYS, code) ? RULE_ENTRY_DETAIL_ARRAYS[code] : undefined;
-    if (key === undefined || detail === undefined)
+const RULE_TEXT_DETAIL_FIELDS = {
+    "permission.allowed_tool_not_granted": { array: "entries", field: "entry" },
+    "permission.rule_row_dropped": { array: "rows", field: "rule" },
+};
+export function redactNoticeRuleText(code, detail) {
+    const at = Object.hasOwn(RULE_TEXT_DETAIL_FIELDS, code) ? RULE_TEXT_DETAIL_FIELDS[code] : undefined;
+    if (at === undefined || detail === undefined)
         return detail;
-    const list = detail[key];
+    const list = detail[at.array];
     if (!Array.isArray(list))
         return detail;
-    const presented = list.map((item) => item !== null && typeof item === "object" && typeof item.entry === "string" ? { ...item, entry: presentRuleEntry(item.entry) } : item);
-    return { ...detail, [key]: presented };
+    const redacted = list.map((item) => {
+        const text = item !== null && typeof item === "object" ? item[at.field] : undefined;
+        return typeof text === "string" ? { ...item, [at.field]: redactListEntry(text) } : item;
+    });
+    return { ...detail, [at.array]: redacted };
 }
 export function engineNoticeEventData(notice, sessionId, nowMs) {
     return {
         code: notice.code,
         message: redactSecrets(String(notice.message)).slice(0, NOTICE_TEXT_MAX),
-        detail: sanitizeNoticeDetail(presentNoticeDetail(notice.code, notice.detail)),
+        detail: sanitizeNoticeDetail(redactNoticeRuleText(notice.code, notice.detail)),
         sessionId,
         ts: nowMs,
     };

package/dist/trace/redact.d.ts

@@ -50,6 +50,7 @@ import { stripFormatCharacters } from "@sema-agent/core";
  * 现役消费方:`src/tool-approval.ts` 的 `durableRuleMaterial`(规则车道素材闸)与语料的 FP=0 格。
  */
 export declare const normalizeForRedaction: typeof stripFormatCharacters;
+export declare const REDACTION_TOKEN_RE_SRC: string;
 export declare function armPoolBudgetForTest(): {
     spanCount: number;
     coveredPositions: number;
@@ -163,6 +164,11 @@ export declare function redactionSpansForTest(text: string, opts?: {
  * 让下游看到"这里有东西被省略了",而不是丢一个空对象或炸掉整条流。
  */
 export declare function redactDeep(value: unknown): unknown;
+/** {@link redactDeep} 的**串叶处置可注入**形:同一只环 / 深度守卫的遍历,只有「一个串叶怎么脱」由调用方给。
+ *  `redactDeep` 本身就是 `leaf = redactSecrets` 的那一档(行为逐字不变)。读面要的是另一档 —— 串叶走
+ *  `redactModelText`(认出凭据形才改写字节,不含凭据形的串逐字节不变),遍历不该因此再写第二份。
+ *  `leaf` 必须是纯的串→串函数且**自己不抛**(抛了就穿出本遍历)。 */
+export declare function redactDeepWith(value: unknown, leaf: (s: string) => string): unknown;
 /**
  * A REDACTED, length-BOUNDED string preview of a structured value — for surfacing a pending tool call's `args`
  * in the assistant inbox ("what is this ask about") WITHOUT leaking secrets or dumping an unbounded payload (a

package/dist/trace/redact.js

@@ -1,7 +1,7 @@
 import { displayUrlOf, stripFormatCharacters } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
 export const normalizeForRedaction = stripFormatCharacters;
-const REDACTION_TOKEN_RE_SRC = String.raw `«redacted(?::[a-z-]{1,16}){0,2}»`;
+export const REDACTION_TOKEN_RE_SRC = String.raw `«redacted(?::[a-z-]{1,16}){0,2}»`;
 const ARM_VALUE_CLASSES = [];
 const atLeast = (cls, min) => {
     ARM_VALUE_CLASSES.push(cls);
@@ -1797,11 +1797,14 @@ export function redactionSpansForTest(text, opts) {
 }
 const REDACT_MAX_DEPTH = 64;
 export function redactDeep(value) {
-    return redactDeepInner(value, 0, new WeakSet());
+    return redactDeepWith(value, redactSecrets);
 }
-function redactDeepInner(value, depth, seen) {
+export function redactDeepWith(value, leaf) {
+    return redactDeepInner(value, 0, new WeakSet(), leaf);
+}
+function redactDeepInner(value, depth, seen, leaf) {
     if (typeof value === "string")
-        return redactSecrets(value);
+        return leaf(value);
     if (!value || typeof value !== "object")
         return value;
     if (seen.has(value))
@@ -1811,11 +1814,8 @@ function redactDeepInner(value, depth, seen) {
     seen.add(value);
     try {
         if (Array.isArray(value))
-            return value.map((v) => redactDeepInner(v, depth + 1, seen));
-        const out = {};
-        for (const [k, v] of Object.entries(value))
-            out[k] = redactDeepInner(v, depth + 1, seen);
-        return out;
+            return value.map((v) => redactDeepInner(v, depth + 1, seen, leaf));
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, redactDeepInner(v, depth + 1, seen, leaf)]));
     }
     finally {
         seen.delete(value);

package/dist/trace/self-minted-wire.d.ts

@@ -21,7 +21,7 @@ export declare const SELF_MINTED_WIRE: {
     /**
      * S-928(7.110.0):`engine_notice` `task.user_steer_undrained` 上**本仓铸**的那一臂。词表属主是 core(`USER_INPUT_UNDRAINED_CAUSES`,两族共用;
      * `leg_end` 由引擎铸、逐字过境,不在本表);本表登记的是「这个值自哪一版起由本服务出现在 wire 上」。`satisfies Record<CrashedCause, …>`:
-     * core 删掉 `crashed` ⇒ `CrashedCause` 成 never ⇒ 本行编译红。码按受理时的车道选(`user-input-ledger.ts` `userInputLaneOf`):本行 = steer 车道。
+     * core 删掉 `crashed` ⇒ `CrashedCause` 成 never ⇒ 本行编译红。码按受理时的车道选(`user-input-ledger.ts` `acceptedInputKindOf`,车道 = core `injectionLaneOf`,码 = core `USER_INPUT_UNDRAINED_FAMILIES`):本行 = steer 车道。
      */
     readonly userSteerUndrainedServerCause: {
         readonly at: "engine_notice task.user_steer_undrained detail.cause(本服务铸的臂;下一条同会话 run 开通告口那一拍)";
@@ -183,6 +183,20 @@ export declare const SELF_MINTED_WIRE: {
                 readonly attr: "redactErrorMessage";
                 readonly since: "7.108.0";
             };
+            /**
+             * 7.120.0:通告 `detail` 里的规则文本 = 条目的脱敏原值(`list-entry-display.ts` `redactListEntry`,经 `engine-notice-wire.ts` 的
+             * `redactNoticeRuleText`;会话流行与运维日志行同一只;不加引号、不转义 —— 显示形只在人读句里)。修前(7.119.0):本仓手抄的呈现形
+             * (剥 C0 / 双向控制符、超过 160 字截断并标原长),运维日志行不脱敏。钉 test/notice-entry-presentation.test.ts。
+             */
+            readonly "engine_notice permission.allowed_tool_not_granted#detail.entries[].entry": {
+                readonly attr: "redactListEntry";
+                readonly since: "7.120.0";
+            };
+            /** 7.120.0:同上一行同一只写法(码本版入册;引擎交来的是它中和过的规则文本,本仓再过脱敏读口)。钉同上「两只码」组。 */
+            readonly "engine_notice permission.rule_row_dropped#detail.rows[].rule": {
+                readonly attr: "redactListEntry";
+                readonly since: "7.120.0";
+            };
         };
     };
 };

package/dist/trace/self-minted-wire.js

@@ -65,6 +65,8 @@ export const SELF_MINTED_WIRE = {
         members: {
             "GET /v1/runs/:id#result.errorMessage": { attr: "redactErrorMessage", since: "7.57.0" },
             "POST /v1/side-query#errorMessage": { attr: "redactErrorMessage", since: "7.108.0" },
+            "engine_notice permission.allowed_tool_not_granted#detail.entries[].entry": { attr: "redactListEntry", since: "7.120.0" },
+            "engine_notice permission.rule_row_dropped#detail.rows[].rule": { attr: "redactListEntry", since: "7.120.0" },
         },
     },
 };

package/dist/user-input-ledger.d.ts

@@ -23,8 +23,9 @@
  * 子代 resume(`…/subagents/:target/resume`)不往在飞的队列里投,起的是一条新的子代腿;follow-up 在本仓**没有**独立的受理口(`src/http/routes` 零
  * follow-up 入口)。steer 的 `later` 档在引擎里走 follow-up 车道(引擎在腿收场时按车道分账:没投出去的 `later` 记进 `task.user_followup_undrained`),
  * 但它仍是一次 `TaskStream.steer` 受理、消费帧同为 `human_input{delivery:"applied"}`(两车道同一只消费口)⇒ 同进本账,消费即结清。
- * **族 = 受理时它排进的引擎车道**({@link UserInputKind}:`steer` / `follow_up`,由档位经 {@link userInputLaneOf} 一只函数得出),崩溃告知的码按族选
- * (core 7.44.0 #1362:两族同一只成因词表 `USER_INPUT_UNDRAINED_CAUSES`,服务层的 `crashed` 臂按车道选码,与引擎自己的 `leg_end` 臂同一种分账)。
+ * **族 = 受理时它排进的引擎车道**(core `UserInputLane`,经引擎的 `injectionLaneOf(steerPriorityOf(…))` 读出 —— {@link acceptedInputKindOf};落盘 / wire 词 {@link UserInputKind}:
+ * `steer` / `follow_up`),崩溃告知的码与条数键按车道取 core `USER_INPUT_UNDRAINED_FAMILIES`(core 7.44.0 #1362:两族同一只成因词表 `USER_INPUT_UNDRAINED_CAUSES`,
+ * 服务层的 `crashed` 臂按车道选族,与引擎自己的 `leg_end` 臂同一种分账;core 7.45.0 #1408 起族表与车道读法在包根,本仓不再抄)。
  *
  * ## 五形行(append-only;行序 = 语义序;File 孪生的盘上形 = 下面的 {@link UserInputLedgerRecord},SQL 孪生 = 一行一受理 + CAS 列 + 删行,同义)
  *  · `accepted`  —— 受理点(`routes/runs.ts` 的 live 腿,**调 `TaskStream.steer` 之前**、回 200 之前)写;写不进 ⇒ 503
@@ -85,28 +86,30 @@
  * 不开旋钮(没有「关掉告知」的正当需求)· 不改 steer 的 200 体(回执仍是「已交付」,账本是它的影子)· 不重放丢失的输入(core 明写
  * NOT redelivered;本账只告知,不替人决定重发)· 不存输入正文(行里只有身份与时刻)。
  */
-import { type EngineNoticeCode, type SystemInjectionPriority, type TaskEvent, type UserInputUndrainedCause } from "@sema-agent/core";
+import { type EngineNoticeCode, type SystemInjectionPriority, type TaskEvent, type UserInputLane, type UserInputUndrainedCause } from "@sema-agent/core";
 import { type RunRecord } from "./plugins/store-contracts.js";
 import { type EngineNoticeRouter } from "./trace/engine-notice-wire.js";
 /** local 数据根下的子目录(File 孪生;与 `approval-ask-audit/` 同层同形)。 */
 export declare const USER_INPUT_LEDGER_DIR = "user-input-ledger";
 /**
- * 账本收的输入族(闭集)= 受理时它排进的**引擎车道**:`steer`(`now` / `next` 档)/ `follow_up`(`later` 档)。崩溃告知的码按族选
- * ({@link UNDRAINED_NOTICE_OF}),读面行的 `kind` 就是它。`follow_up` 自 7.118.0 起写(之前的版本受理口一律写 `steer`,`later` 档的旧行照它当时的族读)。
+ * 账本收的输入族 = 受理时它排进的**引擎车道**(core `UserInputLane`:`steer` / `followUp`;车道怎么读、每条车道的告知码与条数键全归 core,见下)。
+ * 本表只做一件事:把车道写成本仓 7.118.0 起**已落盘、已上 wire**(`GET /v1/sessions/:id` 的 `userInputUndrained[].kind`)的那个词 —— `steer` / `follow_up`。
+ * `satisfies Record<UserInputLane, …>`:core 加一条车道 ⇒ 编译红,由人裁它落盘写什么。`follow_up` 自 7.118.0 起写(之前的版本受理口一律写 `steer`,`later` 档的旧行照它当时的族读)。
  */
-export type UserInputKind = "steer" | "follow_up";
-/** 读盘词表(`satisfies Record<…, true>` ⇒ 闭集加词而本表没跟 = 编译红;判定走 `Object.hasOwn`)。≤7.117.x 的读腿不认 `follow_up`(回滚须知在 MIGRATION)。 */
-export declare const USER_INPUT_KIND_WORDS: {
-    readonly steer: true;
-    readonly follow_up: true;
+declare const LEDGER_KIND_OF_LANE: {
+    readonly steer: "steer";
+    readonly followUp: "follow_up";
 };
+/** 落盘 / wire 的族词(闭集,派生自 {@link LEDGER_KIND_OF_LANE})。 */
+export type UserInputKind = (typeof LEDGER_KIND_OF_LANE)[UserInputLane];
+/** 读盘词表(判定走 `Object.hasOwn`;派生自 {@link LEDGER_KIND_OF_LANE})。≤7.117.x 的读腿不认 `follow_up`(回滚须知在 MIGRATION)。 */
+export declare const USER_INPUT_KIND_WORDS: Readonly<Record<UserInputKind, true>>;
 /**
- * 一次受理排进哪条引擎车道 —— 三个受理口(run steer 的 live 腿 / interrupt 带 text 形 / 子代 steer)同调这一只。core 原句(`TaskStream.steer` 注):
- * 「a `"later"` steer rides the followUp lane, so its stranded account is `task.user_followup_undrained`」;`now` / `next` 走 steer 车道。
- * 档位型取 core 包根的 `SystemInjectionPriority`(`TaskStream.steer` 的 `priority`;缺席 = 引擎缺省 `next`),本仓不复述:core 加一档 ⇒ 下面的
- * 穷举 `never` 臂编译红,由人裁新档排进哪条车道。
+ * 一次受理的族词 —— 三个受理口(run steer 的 live 腿 / interrupt 带 text 形 / 子代 steer)同调这一只。车道是引擎的那一只读法
+ * `injectionLaneOf(steerPriorityOf(…))`(core 7.45.0 #1408:缺席档 = `next`;`later` 走 follow-up 车道,`now` / `next` 走 steer 车道;
+ * 档外值抛 `steering.invalid_content` —— 受理口在这之前已按 `isSystemInjectionPriority` 400 掉档外值,这一抛在本仓不可达)。
  */
-export declare function userInputLaneOf(tier: SystemInjectionPriority | undefined): UserInputKind;
+export declare function acceptedInputKindOf(priority: SystemInjectionPriority | undefined): UserInputKind;
 /** `settled` 的两种收场(闭集,见顶注)。 */
 export type SettleHow = "leg_end" | "not_applied" | "consumed";
 /** 读盘词表(File 孪生的折叠守卫 / SQL 孪生的 `settle_how` 列读腿同读这一张;`consumed` 自 7.113.0 起,≤7.112.x 的读腿不认它 —— 回滚须知在 MIGRATION)。 */
@@ -380,4 +383,5 @@ export declare function createUserInputLedgerAtBoot(opts: Parameters<typeof crea
  *  · `mysql` / `pg` —— 多副本共享一张表,「我启动之前写的」证明不了写者已死 ⇒ `run_store_verdict`(等 reaper 落款)。
  */
 export declare function writerGoneEvidenceFor(backendKind: "mysql" | "pg" | "local", runs: RunStoreReader): WriterGoneEvidence;
+export {};
 //# sourceMappingURL=user-input-ledger.d.ts.map

package/dist/user-input-ledger.js

@@ -1,22 +1,13 @@
-import { USER_INPUT_UNDRAINED_CAUSES } from "@sema-agent/core";
+import { USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES, injectionLaneOf, steerPriorityOf } from "@sema-agent/core";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { isHolderDeathVerdict } from "./plugins/store-contracts.js";
 import { defaultEngineNoticeRouter } from "./trace/engine-notice-wire.js";
 export const USER_INPUT_LEDGER_DIR = "user-input-ledger";
-export const USER_INPUT_KIND_WORDS = { steer: true, follow_up: true };
-export function userInputLaneOf(tier) {
-    switch (tier) {
-        case "later":
-            return "follow_up";
-        case "now":
-        case "next":
-        case undefined:
-            return "steer";
-        default: {
-            const unhandled = tier;
-            throw new Error(`unhandled steer tier: ${String(unhandled)}`);
-        }
-    }
+const LEDGER_KIND_OF_LANE = { steer: "steer", followUp: "follow_up" };
+const LANE_OF_LEDGER_KIND = Object.fromEntries(Object.entries(LEDGER_KIND_OF_LANE).map(([lane, kind]) => [kind, lane]));
+export const USER_INPUT_KIND_WORDS = Object.freeze(Object.fromEntries(Object.values(LEDGER_KIND_OF_LANE).map((kind) => [kind, true])));
+export function acceptedInputKindOf(priority) {
+    return LEDGER_KIND_OF_LANE[injectionLaneOf(steerPriorityOf(priority === undefined ? {} : { priority }))];
 }
 export const SETTLE_HOW_WORDS = { leg_end: true, not_applied: true, consumed: true };
 const UNDRAINED_CAUSE_MINTER = { leg_end: "engine", crashed: "server" };
@@ -138,15 +129,16 @@ export function sortAcceptances(list) {
 export const USER_INPUT_OPEN_SCAN_MAX = 1000;
 export const USER_INPUT_OPEN_SCAN_PAGES = 100;
 export const USER_INPUT_SESSION_READ_MAX = 500;
-const UNDRAINED_NOTICE_OF = {
-    steer: { code: "task.user_steer_undrained", countKey: "steer", what: "user steer(s)" },
-    follow_up: { code: "task.user_followup_undrained", countKey: "followUp", what: "user steer(s) queued for the run's end (priority later)" },
+const UNDRAINED_WHAT_OF_LANE = {
+    steer: "user steer(s)",
+    followUp: "user steer(s) queued for the run's end (priority later)",
 };
 export function buildCrashedUndrainedNotice(input) {
-    const face = UNDRAINED_NOTICE_OF[input.family];
+    const lane = LANE_OF_LEDGER_KIND[input.family];
+    const face = USER_INPUT_UNDRAINED_FAMILIES[lane];
     return {
         code: face.code,
-        message: `Check the earlier run's transcript and results before re-sending any of these steers to a live run. The server accepted ${input.count} ${face.what} for run ${input.taskId} (each answered 200 applied or 202 queued-immediate), but the process running that run ended before the engine confirmed consuming them. They are NOT redelivered.`,
+        message: `Check the earlier run's transcript and results before re-sending any of these steers to a live run. The server accepted ${input.count} ${UNDRAINED_WHAT_OF_LANE[lane]} for run ${input.taskId} (each answered 200 applied or 202 queued-immediate), but the process running that run ended before the engine confirmed consuming them. They are NOT redelivered.`,
         detail: { [face.countKey]: input.count, cause: CRASHED_CAUSE, taskId: input.taskId, sessionId: input.sessionId },
         sessionId: input.sessionId,
     };