@sema-agent/server 7.136.0 → 7.138.0

package/dist/task-mcp.d.ts

@@ -24,7 +24,8 @@
  */
 import { type CompliancePosture, type EngineNotice, type LockedKey, type McpInjectionDropReason, type McpServerSpec } from "@sema-agent/core";
 import { type McpIdentityHeadersIssue, type RequestMcpServerSpec } from "./mcp-assertion-header.js";
-import { type DeclarationRefusal } from "./request-declaration-refusal.js";
+import { type McpDraft, type PeerDesk, type PeerLease } from "./peer-seat.js";
+import { type DeclarationKeyIssue, type DeclarationRefusal } from "./request-declaration-refusal.js";
 import type { StoredToolAxesRereadM19 } from "./stored-request-tool-axes-m19.js";
 /** Bound on caller-supplied servers (anti-DoS; a real local `.mcp.json` has a handful). */
 export declare const MAX_REQUEST_MCP_SERVERS = 32;
@@ -52,11 +53,11 @@ export declare const MAX_REQUEST_MCP_DROP_NAMES = 32;
  * 再写一份就是一份手抄投影([ref]:任何仓第一排查点),而两份哪天分岔,窄的那一份会把**合法**的键当成
  * 拼写错误 400 掉。
  *
- * ## 🔴 两向钉在 core 的 `McpServerSpec` 上(不是手抄)
- * 下面六道编译期门:型上多一个键而表没跟 ⇒ 红;表里写一个型上没有的词(改名 / 拼错 / 删键后的残条目)
- * ⇒ 也红。于是这三张表是从 core 的型**派生**出来的数据,而不是誰记得去同步的清单。
- * (唯一一格不在 core 型上的键 = http 传输的 `assertionHeader`:引擎尚无座,本仓承载 —— 那一支的门钉在
- * `mcp-assertion-header.ts` 的 {@link RequestMcpServerSpec} 上,引擎一旦长出同名座,那里的退役门当场红。)
+ * ## 🔴 两向钉在请求面条目形上(不是手抄)
+ * 条目层:下面四道编译期门两向钉在请求面条目形 {@link RequestMcpServerSpec}(条目层 = 引擎 `McpServerSpec` 的条目层)上:型上多一个键而表没跟 ⇒ 红;表里写一个型上没有的词
+ * (改名 / 拼错 / 删键后的残条目)⇒ 也红。传输层:两张键表**就是**两臂处置表的键(`mcp-assertion-header.ts` 的 {@link MCP_STDIO_TRANSPORT_DISPOSITION} /
+ * {@link MCP_HTTP_TRANSPORT_DISPOSITION}),处置表对契约包的请求传输形两向钉、对引擎的传输形再钉两道 —— 一张表同时说「收哪些键」与「每个键去哪」。
+ * 于是这几张表是从型**派生**出来的数据,而不是谁记得去同步的清单。
  *
  * ## 一个回答者,两扇门;读器另算
  * 「这份声明能不能原样用」只有 {@link requestMcpDeclarationRefusal} 一只回答者:词表外的键(条目层 / 本形 `transport` 层)⇒ `400 request.body_shape` 带 `unknownKeys`,
@@ -66,12 +67,11 @@ export declare const MAX_REQUEST_MCP_DROP_NAMES = 32;
  * ## 受理键的判官表也钉在这张表上
  * 逐键判官表 {@link ENTRY_KEY_JUDGES} 是 `{ [K in 本表的键]: 判官 }` 的映射型 —— 本表多一个键而没写判官 ⇒ 编译红,不会出现「这个键写坏了却被悄悄受理」的新键。
  */
-export declare const MCP_SERVER_ENTRY_KEYS: readonly ["allowTools", "contentOrigin", "elicitation", "name", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
-/** `transport.kind:"stdio"` 的键闭集(两向钉在 core 那一支上)。 */
-export declare const STDIO_MCP_TRANSPORT_KEYS: readonly ["args", "command", "env", "kind"];
-/** `transport.kind:"http"` 的键闭集(同上)。`assertionHeader` 是本仓承载、引擎尚无座的一格(见 {@link RequestMcpServerSpec}):
- *  表两向钉在**请求面的 http 传输型**上 = 引擎的键 ∪ 这一格;引擎一旦长出同名座,`mcp-assertion-header.ts` 的退役门当场红。 */
-export declare const HTTP_MCP_TRANSPORT_KEYS: readonly ["assertionHeader", "headers", "kind", "principalHeader", "url"];
+export declare const MCP_SERVER_ENTRY_KEYS: readonly ["allowTools", "contentOrigin", "elicitation", "name", "sessionMetaKey", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
+/** `transport.kind:"stdio"` 的键闭集 = stdio 臂处置表的键(`env` 是件,其余进声明)。 */
+export declare const STDIO_MCP_TRANSPORT_KEYS: readonly ("kind" | "command" | "args" | "env")[];
+/** `transport.kind:"http"` 的键闭集 = http 臂处置表的键(`headers` 是件,`assertionHeader` 承载不发送,其余进声明)。 */
+export declare const HTTP_MCP_TRANSPORT_KEYS: readonly ("kind" | "url" | "principalHeader" | "headers" | "assertionHeader")[];
 /**
  * Does THIS deployment honor caller-supplied per-request MCP servers? TRUE for a SINGLE-USER deployment
  * (deployment-shape row `multiTenant` does not hold) — the requester is the super-admin of their own worker, so their `.mcp.json` is
@@ -157,9 +157,10 @@ export declare function requestEntryIdentityIssue(entry: unknown): McpIdentityHe
  *     `startupTimeoutMs` = 引擎根导出的 `mcpStartupTimeoutMs`(坏值抛 `config.mcp_startup_timeout_invalid`,本门把那一句作原因句);`contentOrigin` = `isContentOriginWord`;`source` = `isMcpSourceLabel`;
  *     `name` = `isUsableWireName`;`allowTools` / `transport.args` = {@link isStringArray};`transport.env` / `headers` = 契约包读器 {@link readRequestMcpTransport} 的纯数据记录读法;`elicitation` = {@link isElicitationFlag};
  *     `transport` 的硬字段(`kind` / `command` / `url`)与软字段(`args` / `env` / `headers` / `principalHeader`)= {@link readRequestMcpTransport}(读器投影 transport 的那一只函数,门读它报的 `lost`;读器在契约包,本仓只据 `lost[0]` 拒、据 `lost` 在重放腿逐处点名);
- *     读器交回的 http `url` 再问「带不带凭据」= 契约包根的 `findUrlCredential`([ref];拒体另带机读 `field` + `reason`,见 {@link transportUrlCredentialIssue})。
+ *     读器交回的 http `url` 再问「带不带凭据」= 契约包根的 `findUrlCredential`([ref];拒体另带机读 `field` + `reason`,见 {@link transportUrlCredentialIssue});
+ *     http `principalHeader` 再问「这个名有没有别的属主」= 引擎包根的 `headerOwnershipCollision`(见 {@link principalHeaderOwnershipIssue})。
  * 于是判官受理的条目,读器({@link normalizeServer})交回的就是申报本身(只差判官自己的合法归一:空容器 / `skillScopeEligible:false` 折成缺席、`toolAxes` 取引擎的拷贝)——
- * 探测口拨的那一份因此就是提交腿会挂的那一份,不另比一遍(另比就是第二只回答者)。唯一按门分的后果是「声明了 `assertionHeader`」这一个事实(引擎尚无座,
+ * 探测口拨的那一份因此就是提交腿会挂的那一份,不另比一遍(另比就是第二只回答者)。唯一按门分的后果是「声明了 `assertionHeader`」这一个事实(本部署不发送断言,
  * 承载、不发送):新提交照挂 + 运维 info,探测口整条拒 —— 判据是同一只谓词 `specWithholdsMcpAssertionHeader`(开关 `MCP_ASSERTION_HEADER_SENT` 假时「声明了」即「被扣下」),不是第二份判法(见 `readMcpProbeBody`)。
  *
  * ## 射程
@@ -184,22 +185,32 @@ export declare function requestMcpDeclarationRefusal(list: unknown): Declaration
  * 交出去的剔掉 `__proto__` 名成员),server 照挂,运维 warn `mcp_transport_members_dropped` 逐处点名 —— 续跑重放腿不静默丢声明。
  */
 export declare function assertRequestMcpEntries(bodyMcp: unknown): void;
+/**
+ * `principalHeader` 的**名**有没有别的属主:判官是引擎包根的 `headerOwnershipCollision`(拨号时判同一条的那一只;这里只问身份头这一个名,件头名由引擎在发送时判)——
+ * 名(任何大小写)是这一协议的传输自己写的头(MCP:`mcp-session-id` · `mcp-protocol-version` · `content-type` · `accept` · `last-event-id`;A2A 没有),或是引擎的断言头
+ * (`connector-assertion`)⇒ 这一台拨号时必被拒,新提交在门上按名拒。原因句只点名**属主的拼写**(引擎 / 协议的词),不回显调用方写的串。
+ * 新提交腿上按名 400(MCP 门表的 `transport`、A2A 判官表的 `principalHeader`)。续跑重放腿不 4xx:MCP 的读器不问它 —— 存量体里这一形照挂,由引擎在拨号时拒那一台、兄弟照挂;
+ * A2A 的读器问同一张判官表 —— 这一条对端整条不进、`a2a_injection_dropped` 点名原因(引擎物化时同样拒那一台;结局同,原因说在本仓这一行)。
+ */
+export declare function principalHeaderOwnershipIssue(principalHeader: string | undefined, protocol: "mcp" | "a2a", path: string): DeclarationKeyIssue | undefined;
 /**
  * The ONE predicate for "this MCP server name belongs to the deployment": the scenario baseline (what mounted for
  * this scenario) ∪ every name the deployment DECLARED (`CenterMcp.reservedNames` — mounted or not, any scenario).
  * A caller can ADD servers but can never SHADOW or REFILL a deployment-declared one: a center entry that was skipped
  * (disabled / missing env ref / malformed `toolFaces`) still occupies its name, otherwise "skipped" would silently
  * mean "free for the caller to remount without the operator's `allowTools` / `toolFaces`" (车CF codex r2 [high]).
- * Same posture as `mergeUserSkills`.
+ * Same posture as `buildRunSkills`.
  */
 export declare function deploymentClosedMcpNames(baseline: McpServerSpec[] | undefined, reservedNames: readonly string[]): ReadonlySet<string>;
 /**
- * Merge GATED per-request MCP servers OVER the deployment baseline (center/config). Names closed by the deployment
- * ({@link deploymentClosedMcpNames}) are dropped from `gated`. `reservedNames` has NO default: a security predicate's
- * input is never implied — a caller with no deployment declaration passes `[]` and says so. Returns the baseline unchanged
- * when nothing is added.
+ * Merge GATED per-request MCP drafts OVER the deployment baseline (center/config): **select first, then mint**. Names closed by the deployment
+ * ({@link deploymentClosedMcpNames}) are dropped from `drafts` before anything is registered — a draft that loses to the deployment never
+ * reaches the desk; each winner is minted once on `desk` under `lease` (`peer-seat.ts` `mintDeclaration`: the reference on its transport, zero
+ * piece values). `desk` / `lease` = the process's peer desk and this leg's host lease (`boot/resolve-spec.ts` passes `peerDesk` and `opts.lease`).
+ * `reservedNames` has NO default: a security predicate's input is never implied — a caller with no deployment declaration passes `[]` and says so.
+ * Returns the baseline unchanged when nothing is added.
  */
-export declare function mergeRequestMcp(baseline: McpServerSpec[] | undefined, gated: McpServerSpec[], reservedNames: readonly string[]): McpServerSpec[] | undefined;
+export declare function mergeRequestMcp(baseline: McpServerSpec[] | undefined, drafts: readonly McpDraft[], reservedNames: readonly string[], desk: Pick<PeerDesk, "declare">, lease: PeerLease): McpServerSpec[] | undefined;
 /**
  * The single entry point the spec-builder calls: compute the effective `TaskSpec.mcp` = deployment baseline + the
  * caller's gated per-request servers. Off the honored lane (or with no caller servers) returns the baseline
@@ -216,7 +227,9 @@ export declare function resolveRequestMcp(baseline: McpServerSpec[] | undefined,
     mcpServers?: {
         reservedNames: readonly string[];
     };
-}, logger?: {
+}, 
+/** 对端座的 desk 与本腿的宿主租约(必填):胜出草稿在它下面铸成带引用的声明 —— 一条腿交给引擎的请求面声明只经它带引用。 */
+desk: Pick<PeerDesk, "declare">, lease: PeerLease, logger?: {
     info?(m: string, meta?: unknown): void;
     warn(m: string, meta?: unknown): void;
 }, 

package/dist/task-mcp.js

@@ -1,19 +1,21 @@
-import { mcpInjectionDroppedNotice, mcpStartupTimeoutMs, readToolFaces, resolveComplianceDenies } from "@sema-agent/core";
+import { MCP_ASSERTION_HEADER, headerOwnershipCollision, judgeSessionMetaKey, mcpInjectionDroppedNotice, mcpStartupTimeoutMs, readToolFaces, resolveComplianceDenies } from "@sema-agent/core";
 import { MCP_CONTENT_ORIGINS, describeBadContentOrigin, describeNotStringArray, describeValueShape, findUrlCredential, isContentOriginWord, isStringArray, isUsableWireName, readRequestMcpTransport, stripControlAndBidi, } from "@sema-agent/settings-schema";
 import { HttpError } from "./security.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 import { MCP_SOURCE_LABEL_MAX, isMcpSourceLabel, readMcpSourceLabel } from "./mcp-source-label.js";
-import { describeMcpAssertionHeaderNotAString, describeMcpIdentityHeadersConflict, mcpIdentityHeadersIssue, noteMcpAssertionHeaderIgnored, noteMcpAssertionHeaderNotSent, specWithholdsMcpAssertionHeader, toCoreMcpServerSpec } from "./mcp-assertion-header.js";
+import { MCP_HTTP_TRANSPORT_DISPOSITION, MCP_STDIO_TRANSPORT_DISPOSITION, describeMcpAssertionHeaderNotAString, describeMcpIdentityHeadersConflict, mcpIdentityHeadersIssue, noteMcpAssertionHeaderIgnored, noteMcpAssertionHeaderNotSent, specWithholdsMcpAssertionHeader, toMcpDraft, } from "./mcp-assertion-header.js";
+import { declarationKeys } from "./plain-string-record.js";
+import { mintDeclaration, peerSentence } from "./peer-seat.js";
 import { MAX_KEY_ECHO, echoKeyName, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { readRequestToolAxes } from "./request-tool-axes.js";
 import { urlCredentialHeaderExit, urlCredentialRefusalReason } from "./url-credential-refusal.js";
 import { MALFORMED_NAME, declarationFieldRefusal, declarationNameIssue, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
-export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
-export const STDIO_MCP_TRANSPORT_KEYS = ["args", "command", "env", "kind"];
-export const HTTP_MCP_TRANSPORT_KEYS = ["assertionHeader", "headers", "kind", "principalHeader", "url"];
+export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "sessionMetaKey", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
+export const STDIO_MCP_TRANSPORT_KEYS = declarationKeys(MCP_STDIO_TRANSPORT_DISPOSITION);
+export const HTTP_MCP_TRANSPORT_KEYS = declarationKeys(MCP_HTTP_TRANSPORT_DISPOSITION);
 export function mcpInjectionHonored(config) {
     if (config.lockedConfigKeys?.includes("mcp") === true)
         return false;
@@ -52,7 +54,7 @@ function normalizeServer(e, noteBadOrigin, storedToolAxes) {
         const again = readRequestToolAxes(storedToolAxes.mcp(o.toolAxes), "mcp");
         if (again.ok) {
             judged = again;
-            toolAxesReread = stripControlAndBidi(axes.problem);
+            toolAxesReread = peerSentence(stripControlAndBidi(axes.problem));
         }
     }
     if (!judged.ok)
@@ -73,6 +75,11 @@ function normalizeServer(e, noteBadOrigin, storedToolAxes) {
         return bad("toolFaces");
     if (faces.faces !== undefined)
         spec.toolFaces = faces.faces;
+    const metaKey = judgeSessionMetaKey(o.sessionMetaKey);
+    if ("problem" in metaKey)
+        return bad("sessionMetaKey");
+    if (metaKey.key !== undefined)
+        spec.sessionMetaKey = metaKey.key;
     return { ok: true, spec, ...(toolAxesReread !== undefined ? { toolAxesReread } : {}), transportLost: read.lost };
 }
 export function validateRequestMcp(raw) {
@@ -92,7 +99,7 @@ function validateRequestMcpEntries(raw, storedToolAxes) {
         if (v.ok) {
             ok.push(v.spec);
             if (v.toolAxesReread !== undefined)
-                toolAxesReread.push({ server: v.spec.name, problem: v.toolAxesReread });
+                toolAxesReread.push({ server: v.spec.name, sentence: v.toolAxesReread });
             if (v.transportLost.length > 0)
                 transportLost.push({ server: v.spec.name, lost: v.transportLost.map((i) => i.path) });
         }
@@ -164,6 +171,17 @@ function transportUrlCredentialIssue(url) {
         return undefined;
     return { path: "transport.url", reason: urlCredentialRefusalReason(found, urlCredentialHeaderExit("transport.headers")), credential: found };
 }
+export function principalHeaderOwnershipIssue(principalHeader, protocol, path) {
+    if (principalHeader === undefined)
+        return undefined;
+    const collision = headerOwnershipCollision({ principalHeader }, protocol);
+    if (collision === undefined)
+        return undefined;
+    return {
+        path,
+        reason: `names the header "${collision.first}" (header names are case-insensitive), which is not the principal header's to own — it is ${protocol === "mcp" && collision.first !== MCP_ASSERTION_HEADER ? "a header the MCP transport writes itself" : "the engine's connector assertion header"}; name the principal header something of its own`,
+    };
+}
 const ENTRY_KEY_JUDGES = {
     allowTools: (o) => o.allowTools === undefined || isStringArray(o.allowTools)
         ? undefined
@@ -177,6 +195,10 @@ const ENTRY_KEY_JUDGES = {
         },
     elicitation: (o) => (o.elicitation === undefined || isElicitationFlag(o.elicitation) ? undefined : { path: "elicitation", reason: `must be a boolean — got ${describeValueShape(o.elicitation)}` }),
     name: declarationNameIssue,
+    sessionMetaKey: (o) => {
+        const read = judgeSessionMetaKey(o.sessionMetaKey);
+        return "problem" in read ? { path: "sessionMetaKey", reason: peerSentence(read.problem) } : undefined;
+    },
     source: (o) => o.source === undefined || isMcpSourceLabel(o.source)
         ? undefined
         : { path: "source", reason: `must be a non-empty string of at most ${MCP_SOURCE_LABEL_MAX} characters (a display label) — got ${describeValueShape(o.source)}` },
@@ -190,16 +212,16 @@ const ENTRY_KEY_JUDGES = {
         catch (e) {
             if (e.code !== "config.mcp_startup_timeout_invalid")
                 throw e;
-            return { path: "startupTimeoutMs", reason: e instanceof Error ? e.message : String(e) };
+            return { path: "startupTimeoutMs", reason: peerSentence(e instanceof Error ? e.message : String(e)) };
         }
     },
     toolAxes: (o) => {
         const read = readRequestToolAxes(o.toolAxes, "mcp");
-        return read.ok ? undefined : { path: "toolAxes", reason: read.problem };
+        return read.ok ? undefined : { path: "toolAxes", reason: peerSentence(read.problem) };
     },
     toolFaces: (o) => {
         const read = readToolFaces(o.toolFaces);
-        return read.ok ? undefined : { path: "toolFaces", reason: read.problem };
+        return read.ok ? undefined : { path: "toolFaces", reason: peerSentence(read.problem) };
     },
     transport: (o) => {
         const read = readRequestMcpTransport(o.transport);
@@ -207,7 +229,9 @@ const ENTRY_KEY_JUDGES = {
             return read.issue;
         if (read.lost[0] !== undefined)
             return read.lost[0];
-        return read.transport.kind === "http" ? transportUrlCredentialIssue(read.transport.url) : undefined;
+        if (read.transport.kind !== "http")
+            return undefined;
+        return transportUrlCredentialIssue(read.transport.url) ?? principalHeaderOwnershipIssue(read.transport.principalHeader, "mcp", "transport.principalHeader");
     },
 };
 function requestEntryRefusal(entry, at) {
@@ -229,27 +253,27 @@ function requestEntryRefusal(entry, at) {
 export function deploymentClosedMcpNames(baseline, reservedNames) {
     return new Set([...(baseline ?? []).map((s) => s.name), ...reservedNames]);
 }
-export function mergeRequestMcp(baseline, gated, reservedNames) {
-    if (gated.length === 0)
+export function mergeRequestMcp(baseline, drafts, reservedNames, desk, lease) {
+    if (drafts.length === 0)
         return baseline;
     const closed = deploymentClosedMcpNames(baseline, reservedNames);
-    const add = gated.filter((s) => !closed.has(s.name));
-    return add.length === 0 ? baseline : [...(baseline ?? []), ...add];
+    const winners = drafts.filter((d) => !closed.has(d.spec.name));
+    return winners.length === 0 ? baseline : [...(baseline ?? []), ...winners.map((d) => mintDeclaration(desk, d, lease))];
 }
-export function resolveRequestMcp(baseline, bodyMcp, config, logger, notice, storedToolAxes) {
+export function resolveRequestMcp(baseline, bodyMcp, config, desk, lease, logger, notice, storedToolAxes) {
     if (bodyMcp === undefined || bodyMcp === null)
         return baseline;
-    const { mcp, drops } = classifyRequestMcp(baseline, bodyMcp, config, logger, storedToolAxes);
+    const { mcp, drops } = classifyRequestMcp(baseline, bodyMcp, config, desk, lease, logger, storedToolAxes);
     mintInjectionDropNotices(drops, notice);
     return mcp;
 }
-function classifyRequestMcp(baseline, bodyMcp, config, logger, storedToolAxes) {
+function classifyRequestMcp(baseline, bodyMcp, config, desk, lease, logger, storedToolAxes) {
     if (bodyMcp !== undefined && bodyMcp !== null && !Array.isArray(bodyMcp)) {
         logger?.warn("mcp_injection_ignored", { reason: "mcpServers not an array" });
         return { mcp: baseline, drops: [] };
     }
     const entries = Array.isArray(bodyMcp) ? bodyMcp : [];
-    const outcome = mcpInjectionHonored(config) ? classifyHonored(baseline, entries, config, logger, storedToolAxes) : classifyGateClosed(baseline, entries);
+    const outcome = mcpInjectionHonored(config) ? classifyHonored(baseline, entries, config, desk, lease, logger, storedToolAxes) : classifyGateClosed(baseline, entries);
     if (outcome.drops.length > 0)
         logger?.warn("mcp_injection_dropped", { dropped: outcome.drops, droppedTotal: outcome.droppedTotal });
     return { mcp: outcome.mcp, drops: outcome.drops };
@@ -261,7 +285,7 @@ function classifyGateClosed(baseline, entries) {
         droppedTotal: entries.length,
     };
 }
-function classifyHonored(baseline, entries, config, logger, storedToolAxes) {
+function classifyHonored(baseline, entries, config, desk, lease, logger, storedToolAxes) {
     const v = validateRequestMcpEntries(entries, storedToolAxes);
     if (v.badContentOrigin.length > 0) {
         logger?.warn("mcp_content_class_dropped", {
@@ -288,7 +312,7 @@ function classifyHonored(baseline, entries, config, logger, storedToolAxes) {
         logger?.warn("mcp_tool_axes_read_as_before_upgrade", {
             server: r.server,
             migration: "M19",
-            problem: r.problem,
+            problem: r.sentence,
             note: "this replayed request was stored before the upgrade and its toolAxes declaration does not pass the engine's reader; while one-time migration M19 is open it is read the way the pre-upgrade server read it (members that did not fit are dropped, a declaration that is not an object counts as none) and the server stays mounted — once the window closes the same request leaves this server unmounted",
         });
     }
@@ -305,7 +329,7 @@ function classifyHonored(baseline, entries, config, logger, storedToolAxes) {
         });
     }
     return {
-        mcp: mergeRequestMcp(baseline, v.ok.map(toCoreMcpServerSpec), reservedNames),
+        mcp: mergeRequestMcp(baseline, v.ok.map(toMcpDraft), reservedNames, desk, lease),
         drops: [...v.dropped, ...blocked.map((server) => ({ server, reason: "name_reserved_by_deployment" }))],
         droppedTotal: v.droppedTotal + blocked.length,
     };

package/dist/task-settings.d.ts

@@ -73,7 +73,7 @@ export declare const PERMISSION_MODE_WORDS: string;
  * through verbatim (`dontAsk` included: folding the auto-deny mode to `default`, the asking mode, would turn a refusal
  * into a card). An UNKNOWN string coerces to `default` (fail-safe: the most-asking mode).
  * [ref]-②: fresh submits can no longer REACH the unknown-word arm — the HTTP gate 400s a non-member value
- * (admission.ts, sibling of promptProfile) and the wire type is a closed enum. This lenient fold stays for the one
+ * (admission.ts, sibling of toolMaterializeStrategy) and the wire type is a closed enum. This lenient fold stays for the one
  * population the gate deliberately does not cover: RESUME replay of a persisted pre-gate body (outputStyle/model
  * two-layer posture — bricking a resume over a value that was legal at submit time is worse than the quiet fold).
  */
@@ -477,7 +477,7 @@ export declare const REQUEST_SETTINGS_REFUSAL_PREFIX = "request settings cannot
 /**
  * Build the per-request permission ToolPolicy from the parsed settings: the two **rule lists** (`deny` / `ask`) through ONE compiler
  * ({@link createRuleListPolicy} → core `createPermissionRulePolicy`) — a `deny` rule hard-blocks, an `ask` rule forces an approval
- * gate, `deny` > `ask` on overlap. 两表的 **covering 语义同源**([ref]):底下是 core 的同一只 `namespacedRuleNameCovers`,本仓不持第二套 glob。
+ * gate, `deny` > `ask` on overlap. 两表的 **covering 语义同源**([ref]):底下是 core 的同一只 `ruleNameCovers`,本仓不持第二套 glob。
  * The `allow` bucket is not here: a policy says deny / ask only (core 7.42.0); the list rides into `TaskSpec.allowedTools` at
  * {@link applyTaskSettings}, the one write point.
  *

package/dist/tool-approval.d.ts

@@ -10,8 +10,9 @@ import { type AskRowEndingCause, type SettleCause, type SettleOutcome } from "./
 import type { ParkCommitWatch } from "./plugins/park-commit-watch.js";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 import { type GovernancePosture } from "./runtime-governance.js";
-import { type GrantBinding, type StandingAnswerCall } from "./standing-answer-grant.js";
+import { type GrantBinding, type StandingAnswerCard } from "./standing-answer-grant.js";
 import { type ApprovalExemptionStore } from "./plugins/approval-exemption-store.js";
+import { type ExtensionRequesterFace } from "./trace/extension-call-face.js";
 /** {@link ToolApprovalCoordinator.adoptOpenAsks} 的读数(装配点进启动日志)。 */
 interface OpenAskAdoption {
     /** 本次接管进活集合的问数。 */
@@ -213,11 +214,14 @@ export declare function carriesDeploymentListQuestion(deploymentListAsks: boolea
  * 本仓**策略层自己交出去的一问**的 {@link StandingAnswerFacts}。读者两个:部署名单门(`approval.ts`,`deploymentListQuestion: true`)与 workflow 问句门
  * (`task-settings.ts`,`false`)—— 它们在交出这一问之前先读按工具名记的耐久豁免店(「本会话不再询问」在本层兑现,继承链上的同一问才够得着;审批席依约不退役
  * 继承问),而**能不能读**与审批席 / 回决写侧是同一只判据({@link standingAnswerDurablyRecordable}):记得下的才代答,记不下的(带授予绑定的问 ……)不代答,
- * 存量行也不例外 —— 一事一读。事实取自**这一问本身**:类集经 core 包根唯一的类派生 `classifyAsk`({@link NO_GATE_FACTS});`requiresRealApproval` /
- * `mandated` 读这一问自报的成员;治理位恒假(本层不是治理层);授予绑定读**调用**(`callGrantBindingOf` —— 本层手里还没有引擎铸的卡,core 7.51.0 不在
- * `ToolCallRequest` 上盖绑定词,[ref] 载体问题见 `standing-answer-grant.ts` 头注)。
+ * 存量行也不例外 —— 一事一读。事实取自**这一问本身**:类集经 core 包根唯一的类派生 `classifyAsk`({@link noGateFacts},调用坐标取 `req`);`requiresRealApproval` /
+ * `mandated` 读这一问自报的成员;治理位恒假(本层不是治理层);授予绑定读**请求上引擎的词**(core 7.59.0 起 Runner 交给策略的 `ToolCallRequest`
+ * 带与卡同一组词;宿主不经 Runner 自建的请求两者都不说 ⇒ `unreadable` ⇒ 不读店,fail-closed —— 见 `standing-answer-grant.ts` 头注)。
  */
-export declare function policyAskStandingAnswerFacts(req: StandingAnswerCall, ask: Extract<PermissionResult, {
+export declare function policyAskStandingAnswerFacts(req: StandingAnswerCard & {
+    readonly toolCallId: string;
+    readonly toolName: string;
+}, ask: Extract<PermissionResult, {
     action: "ask";
 }>, deploymentListQuestion: boolean): StandingAnswerFacts;
 /**
@@ -239,8 +243,8 @@ export interface StandingAnswerFacts {
     readonly mandated: boolean;
     /** 这一问的应答**授不授予**这一次调用之外的东西、授予的话绑定是什么(批准引擎的 `Skill` = 激活技能 + 本 run 内清单免问)。
      *  `bound` ⇒ 站着的答案按「工具 + 绑定」记、只代答绑定相同的问(core 7.43.0 [ref] / [ref]:活的问与停驻行同带 `boundGrantDigest`);
-     *  `unreadable` ⇒ 不可记、不被代答(fail-closed)。读者一律经 `standing-answer-grant.ts` 折这一位:载体由问的属主定(`questionGrantBindingOf`)——
-     *  引擎铸的问读卡上引擎的词(`grantBindingOf`),部署名单自己的问与策略层的调用读 `callGrantBindingOf`([ref])。 */
+     *  `unreadable` ⇒ 不可记、不被代答(fail-closed)。读者一律经 `standing-answer-grant.ts` 的唯一读口 `grantBindingOf` 折这一位:只读载体上引擎的词,
+     *  载体不论(卡、停驻行、队列行、策略层的请求)。 */
     readonly grantBinding: GrantBinding;
     /** 引擎盖在这一问上的**类集**(`AskRequest.classes` / 停驻行孪生座;经 core 的屏 `screenAskClassMembers` 读)。`undefined` = 卡上没有类
      *  (老引擎 / 不盖类的站)或屏拒 —— 读不出的类不是「无类」。 */
@@ -471,6 +475,14 @@ export interface ToolApprovalFrame {
      * ask」,治理策略产的与普通策略产的在这一个词上同形 ⇒ 顶替不了(逐字论证见 `governance-ask-marks.ts` 顶注)。
      */
     origin?: string;
+    /**
+     * **ADDITIVE,`"tool_approval"` only** —— 这一问的调用是**一张扩展注册自己发起**的(`$.tool.call`,core 7.56.0 `AskRequest.requestedBy`):
+     * `{ kind: "extension", name }`,卡上「扩展 X 想跑 …」那一行的出处。模型消息带来的调用上缺席。display 事实,不是裁决输入。
+     * 读法与 `tool_start` / `tool_end` 上的同名键是同一只(`trace/extension-call-face.ts`:注册名过注册方文本的出口纪律,与 `wiring_manifest.mods[]` 的 `name`
+     * 逐字节同;形不对 ⇒ 丢 + 计一次)。呈卡腿上它是 `approval_request` 顶层的卡外座之一(`APPROVAL_REQUEST_LIVE_FACT_KEYS`,同一只帧对象的值);
+     * ⚠️ `card_json` 卡面不带本键(卡的键集属主在契约包),断连重放帧上它恒缺席(与其余卡外座同)。
+     */
+    requestedBy?: ExtensionRequesterFace;
     /**
      * **[ref] ②(core 7.37.0 [ref];ADDITIVE,`"tool_approval"` only)** —— 这一问的**类**:`classes` 的首员(core `ASK_CLASSES` 序),
      * `MODE_ARBITRATION` 的行键(权限模式读的就是它 / 它们)。引擎在每一个铸 `origin` 的站盖章(策略自报的值在盖章处被替换),本仓经
@@ -496,7 +508,7 @@ export interface ToolApprovalFrame {
     /** [ref](core 7.51.0 [ref],**ADDITIVE**,`"tool_approval"` only):这张卡为什么没有 {@link boundGrantDigest} —— 引擎铸的每张卡恰带两者之一:
      *  `not_bindable`(这一问不是引擎 `Skill` 工具的激活,不绑任何授予 ⇒ 应答可按工具记)/ `unreadable`(绑着却读不出;活卡上引擎恒给摘要,这一词
      *  只出现在读存量行的面上)。闭集经 `readClosedWordSeat(req, "boundGrantAbsence")` 窄读(筛 = core `BOUND_GRANT_ABSENCES`),集外 ⇒ 缺席 + 计一次。
-     *  与停驻行 / 运维队列行 / inbox 行的同名位同值;站着的答案的授予绑定(引擎铸的问那一家;部署名单自己的问读调用口)读它(`standing-answer-grant.ts` `grantBindingOf`)。display。 */
+     *  与停驻行 / 运维队列行 / inbox 行的同名位同值;站着的答案的授予绑定读它(`standing-answer-grant.ts` `grantBindingOf`,问是谁的都同读)。display。 */
     boundGrantAbsence?: BoundGrantAbsence;
     /** core 7.43.0 [ref]:分类器没给判词的成因词(`error` / `timeout` / `parse_error`;只在类 `classifier_no_ruling` 的卡上)。闭集经 core 的
      *  `readClosedWordSeat(req, "classifierNoRuling")` 窄读(筛 = core `isAutoModeFallbackCause`),集外 ⇒ 缺席 + 计一次。display:本仓不按它裁决。 */
@@ -1027,6 +1039,13 @@ export type UnattendedAskOutcome = Extract<AskOutcome, "unavailable"> | Unattend
 /** [ref] 候裁 16:耐久会话授权店(`src/plugins/approval-exemption-store.ts` 的同一只店):审批席读它(引擎的问),活卡上部署名单那一问的
  *  「本会话放行」写它(名单门在出问之前读同一行)。 */
 export type SessionGrantStore = Pick<ApprovalExemptionStore, "has" | "grant">;
+/** redactDeep + size-bound the UNTRUSTED tool args before they are streamed. Over the cap / unserializable ⇒
+ *  undefined (frame rides argsOmitted — see MAX_APPROVAL_ARGS_BYTES). */
+/**
+ * 给审批人看的一份入参 —— 卡上 `args` 的**同一种读法**({@link boundArgs}:脱敏 + 字节帽;超帽 / 序列化不出 ⇒ `undefined`)。
+ * 读者:卡帧 / 卡面(经 `boundArgs` 本体)与续跑拒体的 `acceptableForm`(core 7.56.0 [ref]:编辑复判只收改写后的那一形,人在决定口看到它、批准它)。
+ */
+export declare function approverFacingArgs(args: unknown): unknown;
 /**
  * [ref] 车3 刀 3b —— 「流内审批协议到底上不上场」的**单一谓词**(设计稿 §2.3 注入 / §2.4 能力面 /
  * §8.4 park 设施自检,三处同一份判据)。
@@ -1591,7 +1610,7 @@ export declare class ToolApprovalCoordinator {
      *    ⇒ 截一个字就恒 `rule_not_offered`,所以**绝不截**;真超尺(= core 放宽了自己的 512 或本仓与 core
      *    版本不同步)⇒ **整条车道撤回**(返回 `undefined`),与本文件既有的治理撤回 / 漂移撤回逐字同形:
      *    少渲一格是安全方向,渲一格按不动的才是 wire 谎言。今天这条臂不可达(每个座都是解析器产物),
-     *    它守的是版本不同步那一形 —— 与 `isSupportedRuleMatch` 的运行期 `default` 同族。
+     *    它守的是版本不同步那一形 —— 与 `isCommandRuleMatch` 的运行期 `default` 同族。
      *
      * 位置在**素材铸点**(与基数帽同一处):两族帧 + `card_json` + 回决口的等式左边从此拿的是**同一份**
      * 已截素材,而不是两处各截一遍。
@@ -1601,7 +1620,22 @@ export declare class ToolApprovalCoordinator {
     private static ruleOfferTextsOverSize;
     /** codex r1 [high]([ref]):offer 的自称座与 `parseRuleText(rule, "allow")` 派生的三元组逐字一致?(理由见调用点) */
     private static ruleOfferDerivedFactsAgree;
+    /**
+     * 一只 single 候选的工具与它的匹配词对得上吗(卡上的 single 只有两族):命令形(exact / prefix / wildcard / pattern)⇒ 规则是 shell 的;
+     * 整工具(`tool`,core 7.57.0:没有规则词替它说话的工具的卡铸「这只工具不再问」)⇒ 工具必须是一键整工具同意落得下的那一族
+     * ({@link cardTakesWholeToolConsent}:没有自己的规则文法、不在 shell 面上 —— 一张 shell 卡上的整工具候选 = 一键放行每一个程序,引擎不铸,兑付时也兑不动)。
+     * 其余匹配词(路径 / 名字 / 主机)不是本服务卡面的 single 候选 ⇒ 丢(那些卡今天没有本服务的规则车道)。穷举 `switch`:core 给匹配词加员时这里编译红。
+     */
+    private static singleOfferToolAgrees;
     private static boundRuleOfferTexts;
+    /**
+     * 这张卡的**绑定值**(`prepareCardApproval` 的 `command`,也是耐久行的 `rule_command`)= 引擎为这张卡铸的候选所说的那一形(core 只按卡的规则形铸候选):
+     *  · 候选全是整工具候选(`match: "tool"`,core 7.57.0;至少一只)⇒ `""` —— 整只工具不绑任何值;core 恰在 `command` 是 `""` 时为这类工具铸卡;
+     *  · 其余(命令形候选,或读者把候选丢光了)⇒ 被裁决的命令原字节 `args.command`(非空串;读不出 ⇒ 没有素材)。空候选表不说「整工具」:
+     *    它什么形都没说,绑定值回到调用自己的命令(编辑面兑的就是它)。
+     * 两形混在一张卡上 = 不是 core 铸得出的卡 ⇒ 没有素材(整条车道撤回,与本文件其余撤回臂同形)。`req.args` 窄读,禁裸 as-cast。
+     */
+    private static cardBindingOf;
     private buildRuleLaneMaterial;
     /** [ref]([ref]/[ref] 双属主裁定):把某 wire run 的**流内未决 ask** 立即转 durable park——断连支专用。
      *  匹配键=`ctxTaskId`(wire run id)。该字段的顶注说它「不是清扫判据」——那是因为清扫要判**连接**的

package/dist/tool-approval.js

@@ -3,6 +3,7 @@ import { heldAskOf, liveSettledBy, readDecidedBy, retiredDecisionKeyFacts, DECID
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7, classifyAsk, foldArbitrationRow, policyCannotAnswer, screenAskClassMembers, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
+import { cardTakesWholeToolConsent } from "./permission-rule-vocab.js";
 import { redactDeep, redactSecrets, redactSecretsWithArms } from "./trace/redact.js";
 import { seatText } from "./trace/exit-seat.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -18,10 +19,12 @@ import { APPROVAL_ENDING_CAUSES, SETTLE_OUTCOME, causeOfAskRow } from "./approva
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 import { governanceOriginOf } from "./runtime-governance.js";
-import { callGrantBindingOf, questionGrantBindingOf } from "./standing-answer-grant.js";
+import { grantBindingOf } from "./standing-answer-grant.js";
 import { operatorAsk } from "./operator-ask.js";
 import { APPROVAL_EXEMPTED_EVENT } from "./plugins/approval-exemption-store.js";
 import { refusalBody } from "./http/refusal-body.js";
+import { withoutSettlementEvidence } from "./gate-settlement.js";
+import { extensionRequesterOf } from "./trace/extension-call-face.js";
 const defaultLogger = createLogger();
 const MAX_APPROVAL_ARGS_BYTES = 16384;
 const DEFAULT_APPROVAL_TTL_MS = 5 * 60_000;
@@ -118,13 +121,15 @@ function askStandingAnswerFacts(req, governanceForced, deploymentListAsks) {
         governanceForced,
         requiresRealApproval: req.requiresRealApproval === true,
         mandated: req.mandated === true,
-        grantBinding: questionGrantBindingOf(req, deploymentListQuestion),
+        grantBinding: grantBindingOf(req),
         classes,
         deploymentListQuestion,
     };
 }
-const NO_GATE_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} };
-const DEPLOYMENT_LIST_ASK_CLASSES = new Set(classifyAsk(operatorAsk("APPROVAL_REQUIRE", ""), NO_GATE_FACTS).classes);
+function noGateFacts(call) {
+    return { call, contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} };
+}
+const DEPLOYMENT_LIST_ASK_CLASSES = new Set(classifyAsk(operatorAsk("APPROVAL_REQUIRE", ""), noGateFacts({ toolCallId: "", toolName: "" })).classes);
 export function carriesDeploymentListQuestion(deploymentListAsks, classes) {
     return deploymentListAsks && classes !== undefined && classes.some((c) => DEPLOYMENT_LIST_ASK_CLASSES.has(c));
 }
@@ -133,8 +138,8 @@ export function policyAskStandingAnswerFacts(req, ask, deploymentListQuestion) {
         governanceForced: false,
         requiresRealApproval: ask.requiresRealApproval === true,
         mandated: ask.mandated === true,
-        grantBinding: callGrantBindingOf(req),
-        classes: [...classifyAsk(ask, NO_GATE_FACTS).classes],
+        grantBinding: grantBindingOf(req),
+        classes: [...classifyAsk(ask, noGateFacts({ toolCallId: req.toolCallId, toolName: req.toolName })).classes],
         deploymentListQuestion,
     };
 }
@@ -170,7 +175,7 @@ export function parkRowStandingAnswerFacts(stored, gate, governance, deploymentL
         governanceForced: governanceOriginOf({ riskDescriptor }, governance) === true,
         requiresRealApproval: readParkRowTrueSeat(pending, "requiresRealApproval"),
         mandated: readParkRowTrueSeat(pending, "mandated") || mandatedFromSeat(readRuleOffersAbsenceSeat(pending)),
-        grantBinding: questionGrantBindingOf(pending, deploymentListQuestion),
+        grantBinding: grantBindingOf(pending),
         classes,
         deploymentListQuestion,
     };
@@ -335,6 +340,9 @@ function unattendedRefusalReason(site) {
 function isChildAsk(req) {
     return req.fromSubagent === true;
 }
+export function approverFacingArgs(args) {
+    return boundArgs(args).args;
+}
 function boundArgs(args) {
     const redacted = redactDeep(args);
     let hasBidi = false;
@@ -745,7 +753,7 @@ export class ToolApprovalCoordinator {
         };
         if (offer.kind === "single") {
             const d = derive(offer.rule);
-            return d !== undefined && d.rule === offer.rule && d.tool === "Bash" && d.match === offer.match && d.command === offer.command;
+            return d !== undefined && d.rule === offer.rule && d.match === offer.match && d.command === offer.command && ToolApprovalCoordinator.singleOfferToolAgrees(d.match, d.tool);
         }
         return offer.rules.every((m) => {
             const d = derive(m.rule);
@@ -761,6 +769,29 @@ export class ToolApprovalCoordinator {
             }
         });
     }
+    static singleOfferToolAgrees(match, tool) {
+        switch (match) {
+            case "exact":
+            case "prefix":
+            case "wildcard":
+            case "pattern":
+                return tool === "Bash";
+            case "tool":
+                return cardTakesWholeToolConsent(tool);
+            case "subpath":
+            case "path":
+            case "name":
+            case "name_prefix":
+            case "host":
+            case "subdomain":
+                return false;
+            default: {
+                const unknown = match;
+                void unknown;
+                return false;
+            }
+        }
+    }
     static boundRuleOfferTexts(offers) {
         const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
         const clipSegment = (s) => (over(s) ? s.slice(0, MAX_RULE_TEXT_CHARS) : s);
@@ -807,6 +838,17 @@ export class ToolApprovalCoordinator {
         }
         return out;
     }
+    static cardBindingOf(args, offers) {
+        const isWholeTool = (o) => o.kind === "single" && o.match === "tool";
+        if (offers.length > 0 && offers.every(isWholeTool))
+            return "";
+        if (offers.some(isWholeTool))
+            return undefined;
+        if (args === null || typeof args !== "object" || Array.isArray(args))
+            return undefined;
+        const command = args.command;
+        return typeof command === "string" && command !== "" ? command : undefined;
+    }
     buildRuleLaneMaterial(req, owner, governanceForced, sessionId) {
         if (this.ruleConsent === undefined)
             return undefined;
@@ -821,11 +863,8 @@ export class ToolApprovalCoordinator {
         const offers = ToolApprovalCoordinator.boundRuleOfferTexts(capped);
         if (offers === undefined)
             return undefined;
-        const args = req.args;
-        if (args === null || typeof args !== "object" || Array.isArray(args))
-            return undefined;
-        const command = args.command;
-        if (typeof command !== "string" || command === "")
+        const command = ToolApprovalCoordinator.cardBindingOf(req.args, offers);
+        if (command === undefined)
             return undefined;
         const boundInputHash = readBoundInputHash(req);
         const scopeRoot = this.ruleScopeRootFor?.(sessionId);
@@ -1290,6 +1329,7 @@ export class ToolApprovalCoordinator {
         const cardWord = readApprovalCard(req.approvalCard);
         const originWord = typeof req.origin === "string" && req.origin.length > 0 ? req.origin : undefined;
         const askClassPair = readAskClassPair(req);
+        const requester = extensionRequesterOf(req.requestedBy, "tool_approval");
         const frame = {
             type: "tool_approval",
             approvalId: id,
@@ -1323,6 +1363,7 @@ export class ToolApprovalCoordinator {
             ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
             ...(originWord !== undefined ? { origin: originWord } : {}),
             ...(askClassPair ?? {}),
+            ...(requester !== undefined ? { requestedBy: requester } : {}),
             ...((d) => (d !== undefined ? { allowRuleShadowed: d } : {}))(readAllowRuleShadowed(req)),
             ...(ruleLaneMaterial !== undefined ? { ruleOffers: ruleLaneMaterial.offers } : {}),
             ...((a) => (a !== undefined ? { ruleOffersAbsence: a } : {}))(readRuleOffersAbsence(req)),
@@ -1856,7 +1897,7 @@ export class ToolApprovalCoordinator {
         }
         const entryClasses = askClassPair?.classes;
         const entryDeploymentListQuestion = carriesDeploymentListQuestion(deploymentListAsks, entryClasses);
-        const entryGrantBinding = questionGrantBindingOf(req, entryDeploymentListQuestion);
+        const entryGrantBinding = grantBindingOf(req);
         const rememberRefused = standingAnswerHome(pendingEntryStandingAnswerFacts({
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
@@ -2581,10 +2622,11 @@ export class ToolApprovalCoordinator {
             if (fresh?.terminal === true && memo.redeemed !== undefined)
                 memo.redeemed.rule = fresh.body;
         }
+        const sameDecision = (parsed.value === "deny") === (receipt.decision === "deny");
         return {
             status: 200,
             body: {
-                ...receipt.body,
+                ...(sameDecision ? receipt.body : withoutSettlementEvidence(receipt.body)),
                 approvalId: id,
                 askId: row.askId,
                 accepted: "parked_redeemed",

package/dist/tool-rule-names.d.ts

@@ -22,6 +22,11 @@
  * 7.53.x 及以前,`MyShell` 的 `egress: true` / `irreversibility: "always"` 会让引擎 `Bash` 的调用多问一次(收紧),它的恒可逆探针会让引擎 `Bash` 的
  * `touch` 不问就跑(放宽);7.54.0 起两者都不再作用于引擎 shell。要收紧引擎 shell:给**正名**叫 `Bash` 的工具声明标记(同名标记仍作用),或请求
  * `TaskSpec.shellGate: "always"`(本仓的入口 `MANUAL_MODE_SHELL_GATE` / 请求 `shellGate`)。
+ * ⚠️ **反方向(core 7.56.0 [ref])**:一次调用的安全轴只按它答得上的名字读,别名不带副本;两个名字的层级**平局时归 wire 名**(真正跑的那只工具)。
+ * 于是 `MyShell{irreversibility:"maybe", aliases:["Bash"]}` 在引擎 shell 被选择器卸下的腿上按 `Bash` 被调时,判它的是 **`MyShell` 自己的探针**
+ * (7.55.x 及以前是引擎 shell 席的形状探针:`ls` 不问就跑、`MyShell` 的探针从未被问)。⇒ 嵌入方给这类工具**照实声明**判它自己命令的探针,
+ * 或不声明层级、或 `irreversibility: "always"`;不声明层级时引擎 shell 席的层级仍够得着它(引擎侧候设计车,问的模式下按 shell 探针问,
+ * `bypassPermissions` 下照放)。本仓自身不声明带别名的工具,零码;这一形只有经 `resolveSpec` 席挂别名工具的嵌入方走得到。
  *
  * 返回**命中的那个名字**(调用答得上的名字里第一个被规则够到的,拼写在先)—— 规则归因(`matchedAskRule`)写运维名单里的那个名,
  * 不写一个名单里查不到的 wire 名;够不到 ⇒ `undefined`。判定式(精确集 / covering 规则)由调用方给,本函数只管「读哪些名字」。