@sema-agent/server 7.125.1 → 7.127.0

package/dist/spec-fields.d.ts

@@ -66,12 +66,12 @@ export declare function skillToolListRefusal(skill: Record<string, unknown>): st
 /** [ref] 单条 agent 定义的形状裁决:null=合法;否则一句可 400 的英文错误(不带索引,调用方自己加)。
  *  白名单外键 fail-loud —— 与 resilience/limits 的「容忍未知键」相反:agents 是能力定义,静默丢字段 =
  *  定义被悄悄削(一个丢掉的 isolation 就是放宽),比 400 更危险,故整条拒。`allowTools` / `denyTools` 本门只判形与条数(`toolList`),
- *  **名字归引擎一只判**(core 7.45.0 #1377 / #1385,开跑前,三来源同判):没有工具能是的拼法(带空白 / 括号形坏 / 不可见字符)、非字符串条目 ⇒ 整 run 拒
- *  `config.agent.unknown_tool`;无人挂的名 ⇒ 不拒、经 `onError`(phase `"config"`)告一次(本仓汇点 `runner_config_advisory`);大小写孪生 / 退役名(`bash` / `BASH`)
- *  ⇒ 开跑前拒 `config.agent.unknown_tool` —— 主车道的委派工具带 extraTools 工厂,本仓在同一处声明它的名册(core 7.46.0 `extraToolNames`;工厂与名册读同一批工具对象,
- *  `capabilities/builtin-tools.ts` `createSubagentExtraTools`),引擎因此列得出子代工具池。两张表管子代手里的**全部**工具:委派池与 hands 内建(`Read` / `Edit` / `Write` /
- *  `Bash` …,core #1430)—— `denyTools:["Write"]` ⇒ 子代没有 `Write`;`allowTools` 只点了调用方工具 ⇒ 子代一只 hands 工具都没有。hands 行之外的引擎工具
- *  (`Monitor` 等)仍不受这两张表管(引擎已知限制)。`denyTools` 的 `Tool(content)` ⇒ 整只工具对该子代藏起并告。本仓不在受理口另做名字对照(那会是同一问的第二个判官)。
+ *  **名字归引擎一只判**(core 7.49.0 #1623 / #1433 第二步起与根 run 的 `allowTools` / `excludeTools` 是同一只选择器,开跑前,三来源同判):没有任何工具答应的名字
+ *  (无人挂的名、大小写孪生 / 退役名 `bash` / `BASH`、坏拼法、非字符串条目)⇒ 整 run 拒 `config.agent.unknown_tool` —— 主车道的委派工具带 extraTools 工厂,本仓在同一处
+ *  声明它的名册(core 7.46.0 `extraToolNames`;工厂与名册读同一批工具对象,`capabilities/builtin-tools.ts` `createSubagentExtraTools`),引擎因此列得出子代工具池。
+ *  两张表管子代可挂载的**全部**工具:委派池、hands 内建、引擎自己的工具(`Monitor` / `Artifact` / `Skill` / 记忆工具 …)与父的 MCP 挂载 ——
+ *  `denyTools:["Monitor"]` ⇒ 子代没有 `Monitor`;`allowTools` 只点了调用方工具 ⇒ 子代只剩那几只与它这条腿的协议工具。`denyTools` 的 `Tool(content)` ⇒ 整只工具。
+ *  本仓不在受理口另做名字对照(那会是同一问的第二个判官)。
  *  ⚠️ 键判断必须 Object.hasOwn:`in` 走原型链,JSON 里的 "toString"/"constructor"/"__proto__" 键会被
  *  误判为白名单字段,随后 SHAPES[k].ok 不是函数 ⇒ TypeError(fresh 500 / resume 砖;cross-review 复现)。 */
 export declare function taskAgentIssue(item: unknown): string | null;
@@ -130,6 +130,22 @@ export declare function retainBackgroundProcessesFromBody(raw: unknown, requireP
  *  DEFENSIVE(resume 重放不过 HTTP 400 门):非数组 ⇒ undefined;项非非空字符串 ⇒ 逐项 DROP;空数组 ⇒
  *  undefined(不挂键=core 缺省,byte-compat)。HTTP 门另有 fail-loud 400(提交面邻居姿势)。 */
 export declare function toolNameListFromBody(raw: unknown): string[] | undefined;
+/** 引擎从哪一版起认 `TaskSpec.allowTools`(core 7.49.0 #1623,[ref])。 */
+export declare const ALLOW_TOOLS_MIN_ENGINE = "7.49.0";
+/**
+ * S-1448(core 7.49.0 #1623 / [ref])—— body.allowTools → `TaskSpec.allowTools`:引擎的**可用性选择器**,原样透传。
+ *
+ * 一条规则:这一 run 能用哪些工具由引擎一只运算答(`universe ∩ ceiling ∩ allow − deny`,prepare 对真实挂载的一切算一次)。
+ * 本仓**零读法** —— 不算补集、不逐项过滤(`[]` = 什么都不给,是合法值,不折成缺席;非串条目与未知名由引擎在 prepare 拒,
+ * `config.tool_face_control`)、不与 allow 层 `allowedTools`(免问)混词。受理门只判 wire 形(与 `excludeTools` / `deferTools` 同一只门)。
+ * 续跑重放同经此处:存量体逐字再投,坏形交引擎拒(收窄键丢了 = 放宽,所以不 DROP)。
+ *
+ * 装着的引擎不认该座(< {@link ALLOW_TOOLS_MIN_ENGINE})⇒ **响亮拒** 400 `request.field_invalid`(点名键、所需版本与装着的版本),
+ * 不静默丢。`engineVersion` 缺省读装着的 core(`CORE_ENGINE_VERSION`);测试传假低版。
+ */
+export declare function allowToolsSpecFragment(raw: unknown, engineVersion?: string): {
+    allowTools?: string[];
+};
 /** [ref]/[ref] — body.promptProfile → `TaskSpec.promptProfile`(core 1.328 R2 主件,CC LT(model_id)
  *  同构双形轴)。语义:纯呈现轴不碰策略(simple=CC 212 短形面缺省;classic=长形面,可按任务/模型试分)
  *  ⇒ 无租户门(deferTools 同姿势);全委托树继承由 core 管。缺省不挂键(引擎缺省 simple,byte-compat)。
@@ -177,10 +193,10 @@ export declare function normalizeApproachNotice(raw: unknown): false | {
  * [ref]④ — body.limits 与 env 墙钟的合成规则(resolveSpec 的唯一 limits 装配点;run-local 无 body 车道不经此):
  *  - `timeoutSec`:body 给了就用 body(caller 明确配速;已在 normalizeLimits 里被 TASK_TIMEOUT_MAX_SEC 封顶)。
  *    body 缺席保持既有姿势 = tenancy 墙钟 + env `TASK_TIMEOUT_SEC` 只抬不降(taskWallClockSec 内 Math.max,
- *    误配低值不能砍 council 预算)。注意两条纪律不叠加:「只抬不降」是 env 对内建缺省墙的规则,body 是
+ *    误配低值不能砍 tenancy 基值)。注意两条纪律不叠加:「只抬不降」是 env 对内建缺省墙的规则,body 是
  *    caller 的显式意图,直接生效(可低于 env 墙 —— 交互短任务要更紧的配速正是本件诉求)。
  *  - `maxOutputTokens` / `maxTurns`:直透传(各自可选 env 上限已 clamp)。
  * 全空 ⇒ undefined(spec 不挂 limits 键,byte-compat)。
  */
-export declare function resolveTaskLimits(bodyLimits: unknown, caps: TaskLimitCaps, envTimeoutSec: number, requirePrincipal: boolean | undefined, big: boolean, warn?: (event: string, fields: Record<string, unknown>) => void): TaskSpec["limits"];
+export declare function resolveTaskLimits(bodyLimits: unknown, caps: TaskLimitCaps, envTimeoutSec: number, requirePrincipal: boolean | undefined, warn?: (event: string, fields: Record<string, unknown>) => void): TaskSpec["limits"];
 //# sourceMappingURL=spec-fields.d.ts.map

package/dist/spec-fields.js

@@ -1,6 +1,8 @@
 import { isThinkingLevel } from "@sema-agent/core";
 import { taskWallClockSec } from "./task-workflow.js";
 import { isAbsoluteHostPath } from "@sema-agent/settings-schema";
+import { CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
+import { createCodedHttpError } from "./security.js";
 import { allowLayerEntryCountIssue, ruleEntryListShapeOk } from "./rule-entry-list.js";
 export function normalizeSuggestNextPrompts(v) {
     if (v === true)
@@ -270,6 +272,23 @@ export function toolNameListFromBody(raw) {
     const names = raw.filter((v) => typeof v === "string" && v.length > 0);
     return names.length > 0 ? names : undefined;
 }
+export const ALLOW_TOOLS_MIN_ENGINE = "7.49.0";
+function engineAtLeast(version, floor) {
+    const parse = (v) => v.split(/[-+]/, 1)[0].split(".").map((n) => Number.parseInt(n, 10) || 0);
+    const [a, b] = [parse(version), parse(floor)];
+    for (let i = 0; i < 3; i++)
+        if ((a[i] ?? 0) !== (b[i] ?? 0))
+            return (a[i] ?? 0) > (b[i] ?? 0);
+    return true;
+}
+export function allowToolsSpecFragment(raw, engineVersion = CORE_ENGINE_VERSION) {
+    if (raw === undefined)
+        return {};
+    if (!engineAtLeast(engineVersion, ALLOW_TOOLS_MIN_ENGINE)) {
+        throw createCodedHttpError(400, "request.field_invalid", `allowTools needs engine ${ALLOW_TOOLS_MIN_ENGINE} or later; this server runs engine ${engineVersion}, which would drop the list and leave every tool available — send the request without allowTools, or upgrade the server`);
+    }
+    return { allowTools: raw };
+}
 export function promptProfileFromBody(raw) {
     return raw === "simple" || raw === "classic" ? raw : undefined;
 }
@@ -318,10 +337,10 @@ export function normalizeApproachNotice(raw) {
     const frac = (n) => typeof n === "number" && Number.isFinite(n) && n > 0 && n <= 1;
     return frac(a) && frac(b) && a <= b ? { at: [a, b] } : undefined;
 }
-export function resolveTaskLimits(bodyLimits, caps, envTimeoutSec, requirePrincipal, big, warn) {
+export function resolveTaskLimits(bodyLimits, caps, envTimeoutSec, requirePrincipal, warn) {
     const dropped = retiredLimitKeysPresent(bodyLimits);
     const requested = normalizeLimits(bodyLimits, caps);
-    const wallSec = taskWallClockSec(envTimeoutSec, requirePrincipal, big);
+    const wallSec = taskWallClockSec(envTimeoutSec, requirePrincipal);
     const maxWalltimeMs = requested?.maxWalltimeMs ?? (wallSec !== undefined ? wallSec * 1000 : undefined);
     if (dropped.length > 0)
         warn?.("task_limits_legacy_key_dropped", { droppedKeys: dropped, effectiveMaxWalltimeMs: maxWalltimeMs ?? null });

package/dist/task-workflow.d.ts

@@ -113,10 +113,12 @@ export declare function normalizeRetainSubagentSessions(raw: unknown): boolean |
  *  - SINGLE-USER turnkey(`requirePrincipal !== true`)= the user IS the superadmin → **NO wall clock**
  *    (undefined; core arms none — its separate wedge safety-net still catches a stuck tool call, so "no wall"
  *    never means "hangs forever"). CC has no whole-task decapitation either.
- *  - MULTI-TENANT: base 2400s (big tasks — council/debate/discuss — 3600s). (PAIR-REVIEW F-4 附带修:此行
- *    曾写 600s/1500s 与代码漂移——真值以下方 base 为准。)
+ *  - MULTI-TENANT: base 2400s (one base: the 3600s big-task lane existed only for council/debate/discuss, which
+ *    left with the engine's team runtime in 7.49.0).
  *  - Explicit `TASK_TIMEOUT_SEC` wins in ANY tenancy (the operator's deliberate wall) and keeps its documented
- *    raise-only floor (`Math.max` with the base, so a misconfigured low value cannot shrink a council budget).
+ *    raise-only floor (`Math.max` with the base, so a misconfigured low value cannot shrink the tenancy base).
  */
-export declare function taskWallClockSec(envTimeoutSec: number, requirePrincipal: boolean | undefined, big: boolean): number | undefined;
+/** 多租户(requirePrincipal)任务墙钟基值(秒)—— 唯一来源:`taskWallClockSec` 与 resolve-spec 的 `server.limits.wallClockBaseSec` 声明都读它(3600 s 大任务档已随团队编排面退役删除)。 */
+export declare const TENANCY_WALL_CLOCK_BASE_SEC = 2400;
+export declare function taskWallClockSec(envTimeoutSec: number, requirePrincipal: boolean | undefined): number | undefined;
 //# sourceMappingURL=task-workflow.d.ts.map

package/dist/task-workflow.js

@@ -39,8 +39,9 @@ export function normalizeRetainSubagentSessions(raw) {
         return undefined;
     return { ...(ttlMs !== undefined ? { ttlMs } : {}), ...(max !== undefined ? { max } : {}) };
 }
-export function taskWallClockSec(envTimeoutSec, requirePrincipal, big) {
-    const base = big ? 3600 : 2400;
+export const TENANCY_WALL_CLOCK_BASE_SEC = 2400;
+export function taskWallClockSec(envTimeoutSec, requirePrincipal) {
+    const base = TENANCY_WALL_CLOCK_BASE_SEC;
     if (envTimeoutSec > 0)
         return Math.max(envTimeoutSec, base);
     return requirePrincipal === true ? base : undefined;

package/dist/tool-approval.d.ts

@@ -1,6 +1,64 @@
+/**
+ * [ref]/[ref]② tool-approval bridge — the SERVICE side of core's `RunnerDeps.onAsk` seam (core `tool-policy.ts`
+ * `resolveAsk`, 1.290's sync-ask leg). The SIBLING of {@link import("./question.js").QuestionCoordinator}: onQuestion
+ * routes the agent's AskUserQuestion tool to a live human; THIS routes a policy `ask` DECISION (e.g. the
+ * `createFsWriteGatePolicy` fs-write gate, an ask-list rule, or a non-durable safety ask) to the live human as a
+ * CC-parity three-choice card (Yes / Yes-allow-all-session / No).
+ *
+ * Wire shape (mirrors question end to end): core adjudicates a tool call `ask` → `resolveAsk(req, onAsk)` calls this
+ * coordinator's `ask` → we mint a pending entry + emit a `tool_approval` SSE frame on the run's live stream → the
+ * shell renders the three-choice card → `POST /v1/tool-approvals/:id/respond` settles the parked promise →
+ * `resolveAsk` maps our boolean to allow/deny. RESPOND BODY selection rationale: the question precedent's body is
+ * core's own QuestionAnswer (a structured multi-answer object) because core FENCES its semantics; an approval has no
+ * core-side answer object — `OnAsk` resolves to a BARE boolean — so the wire body is a minimal closed enum
+ * `{decision: "allow" | "allow_session" | "deny"}` mapping 1:1 onto the CC card's three choices (no free text = no
+ * fence needed; "allow_session" carries the Yes-allow-all intent that a boolean cannot).
+ *
+ * Session state ([ref]② "桥内会话态"): `allow_session` remembers a per-CAPABILITY grant keyed by
+ * `[owner, sessionId, category]` — a LATER ask in that (owner, session) whose tool maps to the SAME category
+ * auto-allows WITHOUT a card (CC 207: "Yes, allow all edits during this session") only through the FOUR-WAY
+ * conjunction at the short-circuit (see `ask`): {@link standingAnswerHome} over the ask's three facts
+ * (NOT governance-forced [ref] 件7/[ref], NOT `requiresRealApproval` [ref], NOT `mandated` S-660 — the SAME
+ * predicate decides whether an `allow_session` answer may MINT a grant, see `finishRespond`) ∧ a truthy sessionId ∧
+ * the grant itself ∧ `sessionGrantUncontestedByRow` (the durable row must not contradict the local peek). The category collapses the
+ * fs-WRITE tool family (Write/Edit/NotebookEdit, canonical space) into ONE bucket `"fs-write"`; any OTHER tool is
+ * its OWN bucket `"tool:<canonical>"`. 🔴 A `allow_session` on a NON-fs-write ask (an irreversible-Bash safety ask,
+ * an ask-list rule on another tool) therefore unlocks ONLY that same tool for the session — it must NEVER unlock the
+ * fs-write family (the "approve a cheap ask once → all future Write/Edit auto-allowed" scope widening, 三路复审 A 组 修2).
+ * The key is scoped to the VERIFIED owner too, so a session id shared across principals cannot inherit another's
+ * grant. This is the cheapest mid-task implementation; a mode SWITCH (default → acceptEdits) still goes through the
+ * shell's intent on the next task ([ref] table).
+ *
+ * 🔒 FAIL-CLOSED everywhere (the inverse of the question lane — an unanswered QUESTION never blocks the run: since
+ * [ref] the coordinator reports `unavailable` and CORE decides the landing, which depends on WHEN the human became
+ * unreachable — at policy time the durable gate says `ask` and the leg parks; once the tool is already running core is
+ * past `suspendAsk`, so it continues on `declined_unavailable`; an unanswered APPROVAL must NOT let the write
+ * proceed): TTL expiry and client disconnect ([ref] `parkOpenAsksForTask` → `forceParkNow`) land on the ONE
+ * unattended-outcome former ({@link ToolApprovalCoordinator.unattendedOutcome}, [ref] R-13) — park route
+ * ("unavailable" ⇒ core durable-parks) by default, a DEPLOYMENT-POLICY refusal (`{allow:false, settledBy:"policy",
+ * reason}` ⇒ core settles `policy_refused`; S-689 — never a bare `false`, which core reads as a PERSON's refusal)
+ * ONLY where the deployment declared `UNATTENDED_APPROVAL_POLICY=deny`; a run ABORT (task cancel → `runCancel`)
+ * still resolves `false` — the row goes VOID, there is nothing left to redeem. Since [ref] G1 (core 1.295
+ * OnAsk 三值化) the "no reachable human" class returns
+ * "unavailable" instead of false — no ALS context AND no bound-closure broker hit(1.258 起 bg/嵌套子代经
+ * spec.onAsk 的 bound 闭包 + streams broker 直达宿主活流,「无 ctx」只剩 durable-submit/headless resume
+ * 残余腿)and emit failure
+ * (card never delivered, and only when this catch is the first settler — a human verdict that raced in during the
+ * await keeps its boolean) ⇒ "unavailable" → core durable-parks (or fail-closed denies without a checkpoint). core's
+ * `resolveAsk` maps false to a deny WITH the ask message, so the model can re-route (deny + continue turn, [ref]⑤).
+ * Owner gate on respond = the VERIFIED principal (gatedPrincipal at the HTTP layer), 404 without an existence oracle
+ * — same posture as question/elicit. The frame's model-authored surfaces (message + args) are secret-REDACTED
+ * before they are streamed; the SIZE bound is per-surface: args ride a byte cap (`MAX_APPROVAL_ARGS_BYTES`,
+ * over-cap ⇒ `argsOmitted`), while the legacy frame's `message` is redacted but NOT length-capped — the char
+ * cap (`MAX_MESSAGE`, approval-card.ts `clip`) lives on the card/`approval_request` projection only (same
+ * redact-at-write contract as question; the args are shown to a human,
+ * never re-fed to a model). No throttle (unlike question): an approval breach-default would be a DENY (task failure),
+ * and asks are turn-blocking by construction — the TTL bounds the human-side exposure instead.
+ */
+import { type ParkedGateFace } from "./approval-content-kind.js";
 import { type ApprovalDecidedBy, type HostSettledBy, type RetiredDecisionKeyFacts } from "./host-decision.js";
 import type { IncomingMessage } from "node:http";
-import { type AskClass, type AskRequest, type AskOutcome, type PermissionResult, type CheckpointGate, type PendingAction, type PersistedRuleMandate, type ReadRootGrantCandidate, type RuleOffer, type AutoModeFallbackCause, type BoundSkillGrants } from "@sema-agent/core";
+import { type AskClass, type AskRequest, type AskOutcome, type PermissionResult, type CheckpointGate, type PendingAction, type PersistedRuleMandate, type ReadRootGrantCandidate, type RuleOffer, type AutoModeFallbackCause, type BoundSkillGrants, type ToolApprovalCard } from "@sema-agent/core";
 import { type CardRulePersisted, type RuleConsentLane } from "./rules-consent.js";
 import { type AllowRuleShadowProjection, type DenialLimitFallback, type RuleOffersAbsence, type ApprovalRequestFrame, type ApprovalRevokeFrame, type RuleEvidenceProjection } from "./approval-card.js";
 import { type ApprovalAskStore, type AskRow } from "./plugins/approval-ask-store-sql.js";
@@ -18,6 +76,11 @@ import { type ApprovalExemptionStore } from "./plugins/approval-exemption-store.
 export declare const APPROVAL_GATE_KINDS: readonly ["human", "irreversible_ask"];
 export type ApprovalGateKind = (typeof APPROVAL_GATE_KINDS)[number];
 export declare function isApprovalGateKind(k: string | undefined): k is ApprovalGateKind;
+/**
+ * 停驻行的到期归 SLA 拒扫腿(deny)而不是作废(expire)?—— **一只谓词**:审批门型 ∧ core `facetOf(gate)` 读作 `A`(问答卡 ⇒ `B`,到期作废;
+ * 无门型 / 非审批门 ⇒ 不归拒扫)。两只店的拒扫选行与作废腿的补集都读这一只(SQL 腿的 `gate_kind IN …` 只是它的粗筛前置,判官仍是 core)。
+ */
+export declare function denySweepOwns(gate: ParkedGateFace | undefined): boolean;
 /** 两方言同形的 SQL IN 片段(值为闭集常量字面,无注入面)。 */
 export declare const APPROVAL_GATE_KINDS_SQL_IN: string;
 /**
@@ -345,7 +408,7 @@ export interface ToolApprovalFrame {
     /**
      * **S-721(core 7.32.0 #1092;ADDITIVE,`"tool_approval"` only)** —— 强制位**站在哪一个词上**:core `PERSISTED_RULE_MANDATES`
      * 六词之一(`operator_always` / `tool_marks` / `probe_mandate` / `probe_unanswered` / `write_protection` /
-     * `write_protection_unresolved`,词义属主在 core)。只在 `mandated: true` 的**整因**是那一个词时在场;另一扇门(治理 / hook /
+     * `target_unresolved`,词义属主在 core)。只在 `mandated: true` 的**整因**是那一个词时在场;另一扇门(治理 / hook /
      * 祖先)或不止一个理由 ⇒ 缺席 —— **缺席从不命名一个词**,也不等于「不强制」(读 `mandated`)。值经 `approval-card.ts` 的
      * `readClosedWordSeat(req, "mandate")` 窄读(闭集筛 = core `isPersistedRuleMandate`,本仓不抄词表;集外词读作缺席 + 计一次)。echo-only:
      * 本仓不按词分支。耐久面同一个词:运维队列行(`parkRowFacts`,park 行孪生座)与 inbox 行(core `CheckpointSummary.mandate`)。
@@ -407,6 +470,15 @@ export interface ToolApprovalFrame {
     /** core 7.43.0 #1353:分类器没给判词的成因词(`error` / `timeout` / `parse_error`;只在类 `classifier_no_ruling` 的卡上)。闭集经 core 的
      *  `readClosedWordSeat(req, "classifierNoRuling")` 窄读(筛 = core `isAutoModeFallbackCause`),集外 ⇒ 缺席 + 计一次。display:本仓不按它裁决。 */
     classifierNoRuling?: AutoModeFallbackCause;
+    /**
+     * **core 7.49.0 #1414(ADDITIVE,`"tool_approval"` only)—— 这一问渲在哪张卡上**:引擎在闸站铸的那一个词(闭集 core `TOOL_APPROVAL_CARDS`:
+     * `file-edit` / `file-write` / `notebook-edit` / `shell` / `fetch` / `plan` / `question` / `generic`),`AskRequest.approvalCard` 逐字过境,经
+     * `approval-content-kind.ts` 的 `readApprovalCard` 闭集窄读(集外 ⇒ 缺席 + 计一次 closed-word-out-of-set)。`question` = 问用户的问题(引擎保留的
+     * 问答工具),不是副作用工具。**本仓不从工具名回推卡**(工具名只作展示):此前按名字铸的 `livePending` 行 / 队列行 `contentKind` 随本键删。
+     * 停驻孪生 = 门的 `gate.approvalCard`(运维队列行顶层同名键,两只店读同一只 `parkedApprovalCard`)。display:本仓不按它裁决。
+     * 🔴 缺席即缺席(宿主自建的 ask / 老引擎),不编 `generic`。⚠️ `card_json` 卡面不带本键(`ApprovalCardSchema` `.strict()`,与 `mandated` 同)。
+     */
+    approvalCard?: ToolApprovalCard;
     /**
      * **[ref]**(core 7.19.0;**ADDITIVE**,`"tool_approval"` only)—— 这只**根外读** ask 的**清障目录**:
      * 把 `dir` 加进本会话的读目录(壳侧既有的 `/add-dir` 口),同一条调用就不会再问。
@@ -675,10 +747,10 @@ export interface LivePendingRow {
      *  子代 ask)上恒等成立。缺席 = 顶层 ask。`fromSubagent` 保留不动(byte-compat:先于本键的消费方仍按
      *  它判别)。 */
     originTaskId?: string;
-    /** [ref]([ref]②):内容问句分型 —— `"content_ask"` 当 `toolName` 为 AskUserQuestion(词属主
-     *  `approval-content-kind.ts`,与 durable 两读面 / core summarize 面同词,OMIT 契约同族)。
-     *  缺席 = 普通工具 ask。展示/分诊分型用,永不参与决议路由。 */
-    contentKind?: "content_ask";
+    /** core 7.49.0 #1414:这一问的卡词 —— 与 {@link frame} 上的 `approvalCard` **同一个值**(行读帧上那一格,不另读一遍),与 durable
+     *  队列行顶层的同名键同层同形(那一面读门的 `gate.approvalCard`)。缺席 = 引擎没给(宿主自建 ask / 老引擎)。展示/分诊用,永不参与决议路由。
+     *  (此前此处是按工具名铸的 `contentKind`,随 #1414 删:卡只有引擎铸的这一个词。) */
+    approvalCard?: ToolApprovalCard;
     /**
      * 🔴 S-454(P1;cli L-397 / 板 [ref]):这只 ask **本来会 emit 的那只活卡帧**。
      *

package/dist/tool-approval.js

@@ -1,4 +1,4 @@
-import { contentKindOf } from "./approval-content-kind.js";
+import { parkedFacetOf, readApprovalCard } from "./approval-content-kind.js";
 import { heldAskOf, liveSettledBy, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "./host-decision.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7, classifyAsk, foldArbitrationRow, policyCannotAnswer, screenAskClassMembers, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
@@ -23,6 +23,9 @@ export const APPROVAL_GATE_KINDS = ["human", "irreversible_ask"];
 export function isApprovalGateKind(k) {
     return k !== undefined && APPROVAL_GATE_KINDS.includes(k);
 }
+export function denySweepOwns(gate) {
+    return isApprovalGateKind(typeof gate?.kind === "string" ? gate.kind : undefined) && parkedFacetOf(gate) === "A";
+}
 export const APPROVAL_GATE_KINDS_SQL_IN = `(${APPROVAL_GATE_KINDS.map((k) => `'${k}'`).join(",")})`;
 const MAX_APPROVAL_ARGS_BYTES = 16384;
 const DEFAULT_APPROVAL_TTL_MS = 5 * 60_000;
@@ -1151,6 +1154,7 @@ export class ToolApprovalCoordinator {
         let ruleLaneMaterial = this.buildRuleLaneMaterial(req, origin.owner, governanceForced, origin.sessionId);
         const mandateWord = readClosedWordSeat(req, "mandate");
         const noRulingCause = readClosedWordSeat(req, "classifierNoRuling");
+        const cardWord = readApprovalCard(req.approvalCard);
         const originWord = typeof req.origin === "string" && req.origin.length > 0 ? req.origin : undefined;
         const askClassPair = readAskClassPair(req);
         const frame = {
@@ -1181,6 +1185,7 @@ export class ToolApprovalCoordinator {
             ...(standingAnswerHome(askStandingAnswerFacts(req, governanceForced, deploymentListAsks)) === "none" ? { rememberRefused: true } : {}),
             ...(typeof req.boundGrantDigest === "string" ? { boundGrantDigest: req.boundGrantDigest, ...(req.boundGrants !== undefined ? { boundGrants: req.boundGrants } : {}) } : {}),
             ...(noRulingCause !== undefined ? { classifierNoRuling: noRulingCause } : {}),
+            ...(cardWord !== undefined ? { approvalCard: cardWord } : {}),
             ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
             ...(originWord !== undefined ? { origin: originWord } : {}),
             ...(askClassPair ?? {}),
@@ -2434,7 +2439,6 @@ export class ToolApprovalCoordinator {
         for (const [id, e] of this.pending) {
             if (scope !== undefined && e.owner !== scope)
                 continue;
-            const contentKind = contentKindOf(e.toolName);
             rows.push({
                 approvalId: id,
                 toolName: e.toolName,
@@ -2448,7 +2452,7 @@ export class ToolApprovalCoordinator {
                 ...(e.mandate !== undefined ? { mandate: e.mandate } : {}),
                 ...(e.origin !== undefined ? { origin: e.origin } : {}),
                 ...(e.originTaskId !== undefined ? { fromSubagent: true, originTaskId: e.originTaskId } : {}),
-                ...(contentKind !== undefined ? { contentKind } : {}),
+                ...(e.frame.approvalCard !== undefined ? { approvalCard: e.frame.approvalCard } : {}),
                 frame: e.frame.approvalId === id ? e.frame : { ...e.frame, approvalId: id },
             });
         }

package/dist/trace/core-keyset-guard.d.ts

@@ -43,14 +43,14 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "approvalCard";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
 type AskFrameServerMinted = "type" | "approvalId" | "argsOmitted" | "outcome" | "governanceForced" | "expiresAtMs" | "expiresInMs" | "serverNowMs" | "parked" | "cause" | "inputHasBidi" | "rememberRefused";
 type _GuardAskFrame = AssertAllKeysHandled<Exclude<keyof ToolApprovalFrame, AskProjected | AskFrameServerMinted>>;
 type _GuardAskFrameReverse = AssertAllKeysHandled<Exclude<AskProjected | AskFrameServerMinted, keyof ToolApprovalFrame>>;
-type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta" | "tool_progress" | "tool_disclosure";
+type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta" | "tool_progress" | "tool_disclosure" | "task_started";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
 type _GuardTaskEventReverse = AssertAllKeysHandled<Exclude<TaskEventHandled, TaskEvent["type"]>>;
 type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
@@ -137,7 +137,7 @@ type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTrace
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
 type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
-type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld" | "authoredBy";
+type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "approvalCard" | "restoreMode" | "checkpointId" | "previewWithheld" | "authoredBy";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
 type ParkArmKeys = keyof Extract<PendingAction, {
@@ -148,8 +148,9 @@ type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCal
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "allowedTools";
-type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "allowedTools" | "allowTools";
+/** 导出:请求体键闭集门(`request-key-closure.ts`)据它锁「本仓记为未接线的引擎座,提交口不许受理」—— 两处分类只能同向。 */
+export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "writeProtectedAdditions" | "complianceAdditionalDenies" | "modelRole" | "enableBlockedReport" | "userAttachments";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction";

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;
@@ -62,6 +62,31 @@ export interface EngineNoticeWireRow {
  *  · 其余(function / symbol / bigint / undefined)⇒ 丢键(JSON 不可承载或语义不明)。
  */
 export declare function sanitizeNoticeDetail(detail: Record<string, unknown> | undefined): Record<string, unknown>;
+/**
+ * `engine_notice` 载荷构造器(三条终点腿同源:live SSE / durable 账本 / 未来的任何第四条腿)。
+ *
+ * 与 `trace/project.ts` 的 `*EventData` 族同纪律(白名单挑键、禁 `{...notice}`),但**不住在那个文件里**:
+ * 那一族的入参全是 core `TaskEvent` 的臂(有 `wire-whitelist-exhaustiveness` 的臂集编译门看着),
+ * 而 `EngineNotice` 不是 `TaskEvent` —— 混进去会让那道门的语义变成"两个不同来源的联合",判别力反而降。
+ */
+/**
+ * 通告 `detail` 里**规则文本**的坐标:码 → `{ 数组键, 元素上的文本键 }`。新码的 detail 带规则文本时在这里登记(一张表,不在各处写分支)。
+ * 规则文本是人或模型写下的条目原串,最可能夹着凭据;这张表管的只有一件事 —— 它离开进程的每一条路都先过 {@link redactListEntry}。
+ * 导出是给钉用的:`test/notice-entry-presentation.test.ts` 的「日志行 = 会话流行」一组逐码迭代这张表,新登记的码自动入组。
+ */
+export declare const RULE_TEXT_DETAIL_FIELDS: Readonly<Record<string, {
+    readonly array: string;
+    readonly field: string;
+}>>;
+/**
+ * 通告 `message`(引擎铸的人读句)的脱敏 —— **唯一一只**:会话流行(经 {@link engineNoticeEventData},之后截到 {@link NOTICE_TEXT_MAX})与运维日志行
+ * (`boot/runner-deps.ts` 的转发席,不截)同调它 ⇒ 同一条通告的 `message` 在两条出路上逐字节同(会话流行另有 {@link NOTICE_TEXT_MAX} 字上限,
+ * 超长的那一截只在日志行上)。对**全部**通告码一视同仁,不按码分支:带规则文本的码(本表 {@link RULE_TEXT_DETAIL_FIELDS} 的登记码)的 `message` 里
+ * 条目以引擎的转义形出现,和别的自由文本一样只在这一只上被认凭据;认出凭据形才改字节,没有凭据形的句子逐字节原样。
+ * ⚠️ 已知边界(既有,两条出路同,见 CHANGELOG 7.120.0「条目」条):引擎把条目里的零宽字符写成 `\uXXXX` 转义,夹零宽字符的凭据在转义后的句子里认不出;
+ * 句子归引擎,本仓不改写 —— 机读位 `detail` 里的规则文本是在原串上认的({@link redactNoticeRuleText}),不受此限。
+ */
+export declare function redactNoticeMessage(message: unknown): string;
 /**
  * 通告 `detail` 里的**规则文本**换成条目的脱敏原值({@link redactListEntry}:凭据换记号,不加引号、不转义 —— 机读位不是显示面,显示形只属于人读句)。
  * 会话流行(经 {@link engineNoticeEventData},之后照常过 {@link sanitizeNoticeDetail})与运维日志行(`boot/runner-deps.ts` 的转发席,其余字段逐字)

package/dist/trace/engine-notice-wire.js

@@ -37,6 +37,8 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "permission.rule_row_dropped",
     "permission.allowed_tool_not_granted",
     "task.tool_turn_incomplete",
+    "route.finish_reason_unknown",
+    "route.stream_end_ignored",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {
@@ -93,10 +95,13 @@ function sanitizeValue(v, depth) {
     }
     return undefined;
 }
-const RULE_TEXT_DETAIL_FIELDS = {
+export const RULE_TEXT_DETAIL_FIELDS = {
     "permission.allowed_tool_not_granted": { array: "entries", field: "entry" },
     "permission.rule_row_dropped": { array: "rows", field: "rule" },
 };
+export function redactNoticeMessage(message) {
+    return redactSecrets(String(message));
+}
 export function redactNoticeRuleText(code, detail) {
     const at = Object.hasOwn(RULE_TEXT_DETAIL_FIELDS, code) ? RULE_TEXT_DETAIL_FIELDS[code] : undefined;
     if (at === undefined || detail === undefined)
@@ -113,7 +118,7 @@ export function redactNoticeRuleText(code, detail) {
 export function engineNoticeEventData(notice, sessionId, nowMs) {
     return {
         code: notice.code,
-        message: redactSecrets(String(notice.message)).slice(0, NOTICE_TEXT_MAX),
+        message: redactNoticeMessage(notice.message).slice(0, NOTICE_TEXT_MAX),
         detail: sanitizeNoticeDetail(redactNoticeRuleText(notice.code, notice.detail)),
         sessionId,
         ts: nowMs,

package/dist/trace/ledger-events.d.ts

@@ -39,9 +39,15 @@ export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" |
 /** [ref](core 7.18.0):本条腿的**延迟工具普查**快照(policy / thresholdPercent? / deferred[] / activated[])。
  *  与 `tool_roster_delta` 同判、同理由——**快照语义**(整只替换,回放零合并),而开腿那一份住在
  *  `wiring_manifest` 之后的首帧、**之后每一次激活**只活在本帧上。整帧缺席 = 这条腿什么都没延迟。
- *  🔴 `tool_progress`([ref])**刻意不在本表**:core 的 `tool_progress.ephemeral` 契约逐字「LIVE ONLY …
- *  core never persists this frame」,与 `task_progress` / `status` 同一处置(两条 durable 腿零 case)。 */
- | "tool_disclosure" | "human_input" | "task_progress" | "task_notification" | "turn_end"
+ *  🔴 `tool_progress`([ref])**刻意不在本表**,理由是它自己的、不是「core 标了 LIVE ONLY」:那一条只是**引擎**的义务
+ *  (不进会话树 / 检查点 / 续跑重放),本仓的账本是异步车道的活流与断线重连面,律是「EPHEMERAL 帧带着回放面没有第二来源的
+ *  事实 ⇒ 落账」(`status` / `task_progress` / `task_started` 都落)。`tool_progress` 的事实由同一只调用的 `tool_end` 推出
+ *  (真源在那里;帧的缺席也从不是证据 —— 一个周期内跑完的调用零帧),所以它不落。 */
+ | "tool_disclosure" | "human_input"
+/** core 7.50.0:委派子代**起跑**帧(每周期一只,先于子代的首个 `task_progress`)。按上面那一条律落账:
+ *  `agentType` / `rootSessionId` / `parentSessionId` / `startedAt` 只骑这一帧,`task_progress` 上没有 ⇒ 不落则异步车道
+ *  (`POST /v1/runs` 的活流就是 `GET /v1/runs/:id/events` 的账本 tail)永远读不到。两条 durable 腿主流 + forward 道各一处写口。 */
+ | "task_started" | "task_progress" | "task_notification" | "turn_end"
 /** park 行名**两个**(`appendParked(kind)` 逐字取自 `result.status`)—— 运行期闭集见
  *  {@link PARK_LEDGER_EVENT_TYPES}(本联合是它的类型面,两者由下方的双向断言锁步)。 */
  | "suspended" | "needs_review" | "done" | "failed" | "suggestions" | "model_usage" | "prompt_assembled" | "config_assembled" | "file_link"

package/dist/trace/ledger-sink.d.ts

@@ -97,6 +97,13 @@ export interface LedgerSink {
  * ⚠️ 用它的前提是**这条腿的全部写口都走它**(混用一个绕开链的写口 = 病灶原样保留)。
  */
 export declare function createSerialLedgerAppend(appendEvent: (seq: number, type: LedgerEventType, data: unknown) => Promise<void>, startSeq: number): (type: LedgerEventType, data: unknown) => Promise<void>;
+/**
+ * durable 腿 forward 道(fire-and-forget,同步回调里不能 await)的写失败出口 —— 一只,两处用:本汇的 `onForwardEvent`(bg 腿 +
+ * sync detach 车道 + 续跑腿的 verify 臂)与续跑腿自己的 forward 回调(`http/resume-legs.ts`,那里另有既有的逐次 warn 行)。
+ * F 类留痕 `server.ledger.forward-append-failed`:这一帧永远不在回放面(子代的起跑帧 / tick / 工具卡),run 照跑、不改任何裁决。
+ * 返回 `.catch` 用的处理器(产物是函数 ⇒ `create*`)。
+ */
+export declare function createForwardAppendFailedNote(type: string): (err: unknown) => void;
 export declare function createLedgerSink(opts: {
     /** The seq-stamped durable append — typically `(seq, type, data) => runStore.appendEvent(taskId, seq, type, data)`. */
     appendEvent: (seq: number, type: LedgerEventType, data: unknown) => Promise<void>;

package/dist/trace/ledger-sink.js

@@ -1,6 +1,7 @@
 import {} from "@sema-agent/core";
 import { outwardPlane } from "../terminal.js";
-import { modelTextEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, turnEndEventData, contextUsageEventData } from "./project.js";
+import { recordFailOpen } from "../observability/fail-open.js";
+import { modelTextEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, turnEndEventData, contextUsageEventData } from "./project.js";
 import { NotifiedKeys, taskNotificationStreamKeyOf } from "../orchestration/workflow-completion-inbox.js";
 import { isParkLedgerEventType } from "./ledger-events.js";
 import { isModelSegmentBoundary, reasoningDeltaBytes, reasoningSegmentEventId } from "./model-segment.js";
@@ -13,6 +14,9 @@ export function createSerialLedgerAppend(appendEvent, startSeq) {
         return step;
     };
 }
+export function createForwardAppendFailedNote(type) {
+    return (err) => recordFailOpen("server.ledger.forward-append-failed", `type=${type} err=${err instanceof Error ? err.message : String(err)}`);
+}
 export function createLedgerSink(opts) {
     const keys = opts.notifiedKeys ?? new NotifiedKeys();
     let seq = 0;
@@ -114,6 +118,9 @@ export function createLedgerSink(opts) {
             case "human_input":
                 await append("human_input", humanInputEventData(ev));
                 break;
+            case "task_started":
+                await append("task_started", taskStartedEventData(ev));
+                break;
             case "task_progress":
                 await append("task_progress", taskProgressEventData(ev));
                 break;
@@ -140,13 +147,16 @@ export function createLedgerSink(opts) {
     const onForwardEvent = (e) => {
         const t = e.type;
         if (t === "task_progress") {
-            void append("task_progress", taskProgressEventData(e)).catch(() => undefined);
+            void append("task_progress", taskProgressEventData(e)).catch(createForwardAppendFailedNote(t));
+        }
+        else if (t === "task_started") {
+            void append("task_started", taskStartedEventData(e)).catch(createForwardAppendFailedNote(t));
         }
         else if (t === "tool_start") {
-            void append("tool_start", toolStartEventData(e)).catch(() => undefined);
+            void append("tool_start", toolStartEventData(e)).catch(createForwardAppendFailedNote(t));
         }
         else if (t === "tool_end") {
-            void append("tool_end", toolEndEventData(e)).catch(() => undefined);
+            void append("tool_end", toolEndEventData(e)).catch(createForwardAppendFailedNote(t));
         }
     };
     const appendStatus = (ev) => {