@sema-agent/server 7.137.0 → 7.138.0

package/dist/tool-approval.d.ts

@@ -10,8 +10,9 @@ import { type AskRowEndingCause, type SettleCause, type SettleOutcome } from "./
 import type { ParkCommitWatch } from "./plugins/park-commit-watch.js";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 import { type GovernancePosture } from "./runtime-governance.js";
-import { type GrantBinding, type StandingAnswerCall } from "./standing-answer-grant.js";
+import { type GrantBinding, type StandingAnswerCard } from "./standing-answer-grant.js";
 import { type ApprovalExemptionStore } from "./plugins/approval-exemption-store.js";
+import { type ExtensionRequesterFace } from "./trace/extension-call-face.js";
 /** {@link ToolApprovalCoordinator.adoptOpenAsks} 的读数(装配点进启动日志)。 */
 interface OpenAskAdoption {
     /** 本次接管进活集合的问数。 */
@@ -214,10 +215,10 @@ export declare function carriesDeploymentListQuestion(deploymentListAsks: boolea
  * (`task-settings.ts`,`false`)—— 它们在交出这一问之前先读按工具名记的耐久豁免店(「本会话不再询问」在本层兑现,继承链上的同一问才够得着;审批席依约不退役
  * 继承问),而**能不能读**与审批席 / 回决写侧是同一只判据({@link standingAnswerDurablyRecordable}):记得下的才代答,记不下的(带授予绑定的问 ……)不代答,
  * 存量行也不例外 —— 一事一读。事实取自**这一问本身**:类集经 core 包根唯一的类派生 `classifyAsk`({@link noGateFacts},调用坐标取 `req`);`requiresRealApproval` /
- * `mandated` 读这一问自报的成员;治理位恒假(本层不是治理层);授予绑定读**调用**(`callGrantBindingOf` —— 本层手里还没有引擎铸的卡,core 7.51.0 不在
- * `ToolCallRequest` 上盖绑定词,[ref] 载体问题见 `standing-answer-grant.ts` 头注)。
+ * `mandated` 读这一问自报的成员;治理位恒假(本层不是治理层);授予绑定读**请求上引擎的词**(core 7.59.0 起 Runner 交给策略的 `ToolCallRequest`
+ * 带与卡同一组词;宿主不经 Runner 自建的请求两者都不说 ⇒ `unreadable` ⇒ 不读店,fail-closed —— 见 `standing-answer-grant.ts` 头注)。
  */
-export declare function policyAskStandingAnswerFacts(req: StandingAnswerCall & {
+export declare function policyAskStandingAnswerFacts(req: StandingAnswerCard & {
     readonly toolCallId: string;
     readonly toolName: string;
 }, ask: Extract<PermissionResult, {
@@ -242,8 +243,8 @@ export interface StandingAnswerFacts {
     readonly mandated: boolean;
     /** 这一问的应答**授不授予**这一次调用之外的东西、授予的话绑定是什么(批准引擎的 `Skill` = 激活技能 + 本 run 内清单免问)。
      *  `bound` ⇒ 站着的答案按「工具 + 绑定」记、只代答绑定相同的问(core 7.43.0 [ref] / [ref]:活的问与停驻行同带 `boundGrantDigest`);
-     *  `unreadable` ⇒ 不可记、不被代答(fail-closed)。读者一律经 `standing-answer-grant.ts` 折这一位:载体由问的属主定(`questionGrantBindingOf`)——
-     *  引擎铸的问读卡上引擎的词(`grantBindingOf`),部署名单自己的问与策略层的调用读 `callGrantBindingOf`([ref])。 */
+     *  `unreadable` ⇒ 不可记、不被代答(fail-closed)。读者一律经 `standing-answer-grant.ts` 的唯一读口 `grantBindingOf` 折这一位:只读载体上引擎的词,
+     *  载体不论(卡、停驻行、队列行、策略层的请求)。 */
     readonly grantBinding: GrantBinding;
     /** 引擎盖在这一问上的**类集**(`AskRequest.classes` / 停驻行孪生座;经 core 的屏 `screenAskClassMembers` 读)。`undefined` = 卡上没有类
      *  (老引擎 / 不盖类的站)或屏拒 —— 读不出的类不是「无类」。 */
@@ -474,6 +475,14 @@ export interface ToolApprovalFrame {
      * ask」,治理策略产的与普通策略产的在这一个词上同形 ⇒ 顶替不了(逐字论证见 `governance-ask-marks.ts` 顶注)。
      */
     origin?: string;
+    /**
+     * **ADDITIVE,`"tool_approval"` only** —— 这一问的调用是**一张扩展注册自己发起**的(`$.tool.call`,core 7.56.0 `AskRequest.requestedBy`):
+     * `{ kind: "extension", name }`,卡上「扩展 X 想跑 …」那一行的出处。模型消息带来的调用上缺席。display 事实,不是裁决输入。
+     * 读法与 `tool_start` / `tool_end` 上的同名键是同一只(`trace/extension-call-face.ts`:注册名过注册方文本的出口纪律,与 `wiring_manifest.mods[]` 的 `name`
+     * 逐字节同;形不对 ⇒ 丢 + 计一次)。呈卡腿上它是 `approval_request` 顶层的卡外座之一(`APPROVAL_REQUEST_LIVE_FACT_KEYS`,同一只帧对象的值);
+     * ⚠️ `card_json` 卡面不带本键(卡的键集属主在契约包),断连重放帧上它恒缺席(与其余卡外座同)。
+     */
+    requestedBy?: ExtensionRequesterFace;
     /**
      * **[ref] ②(core 7.37.0 [ref];ADDITIVE,`"tool_approval"` only)** —— 这一问的**类**:`classes` 的首员(core `ASK_CLASSES` 序),
      * `MODE_ARBITRATION` 的行键(权限模式读的就是它 / 它们)。引擎在每一个铸 `origin` 的站盖章(策略自报的值在盖章处被替换),本仓经
@@ -499,7 +508,7 @@ export interface ToolApprovalFrame {
     /** [ref](core 7.51.0 [ref],**ADDITIVE**,`"tool_approval"` only):这张卡为什么没有 {@link boundGrantDigest} —— 引擎铸的每张卡恰带两者之一:
      *  `not_bindable`(这一问不是引擎 `Skill` 工具的激活,不绑任何授予 ⇒ 应答可按工具记)/ `unreadable`(绑着却读不出;活卡上引擎恒给摘要,这一词
      *  只出现在读存量行的面上)。闭集经 `readClosedWordSeat(req, "boundGrantAbsence")` 窄读(筛 = core `BOUND_GRANT_ABSENCES`),集外 ⇒ 缺席 + 计一次。
-     *  与停驻行 / 运维队列行 / inbox 行的同名位同值;站着的答案的授予绑定(引擎铸的问那一家;部署名单自己的问读调用口)读它(`standing-answer-grant.ts` `grantBindingOf`)。display。 */
+     *  与停驻行 / 运维队列行 / inbox 行的同名位同值;站着的答案的授予绑定读它(`standing-answer-grant.ts` `grantBindingOf`,问是谁的都同读)。display。 */
     boundGrantAbsence?: BoundGrantAbsence;
     /** core 7.43.0 [ref]:分类器没给判词的成因词(`error` / `timeout` / `parse_error`;只在类 `classifier_no_ruling` 的卡上)。闭集经 core 的
      *  `readClosedWordSeat(req, "classifierNoRuling")` 窄读(筛 = core `isAutoModeFallbackCause`),集外 ⇒ 缺席 + 计一次。display:本仓不按它裁决。 */
@@ -1601,7 +1610,7 @@ export declare class ToolApprovalCoordinator {
      *    ⇒ 截一个字就恒 `rule_not_offered`,所以**绝不截**;真超尺(= core 放宽了自己的 512 或本仓与 core
      *    版本不同步)⇒ **整条车道撤回**(返回 `undefined`),与本文件既有的治理撤回 / 漂移撤回逐字同形:
      *    少渲一格是安全方向,渲一格按不动的才是 wire 谎言。今天这条臂不可达(每个座都是解析器产物),
-     *    它守的是版本不同步那一形 —— 与 `isSupportedRuleMatch` 的运行期 `default` 同族。
+     *    它守的是版本不同步那一形 —— 与 `isCommandRuleMatch` 的运行期 `default` 同族。
      *
      * 位置在**素材铸点**(与基数帽同一处):两族帧 + `card_json` + 回决口的等式左边从此拿的是**同一份**
      * 已截素材,而不是两处各截一遍。
@@ -1611,7 +1620,22 @@ export declare class ToolApprovalCoordinator {
     private static ruleOfferTextsOverSize;
     /** codex r1 [high]([ref]):offer 的自称座与 `parseRuleText(rule, "allow")` 派生的三元组逐字一致?(理由见调用点) */
     private static ruleOfferDerivedFactsAgree;
+    /**
+     * 一只 single 候选的工具与它的匹配词对得上吗(卡上的 single 只有两族):命令形(exact / prefix / wildcard / pattern)⇒ 规则是 shell 的;
+     * 整工具(`tool`,core 7.57.0:没有规则词替它说话的工具的卡铸「这只工具不再问」)⇒ 工具必须是一键整工具同意落得下的那一族
+     * ({@link cardTakesWholeToolConsent}:没有自己的规则文法、不在 shell 面上 —— 一张 shell 卡上的整工具候选 = 一键放行每一个程序,引擎不铸,兑付时也兑不动)。
+     * 其余匹配词(路径 / 名字 / 主机)不是本服务卡面的 single 候选 ⇒ 丢(那些卡今天没有本服务的规则车道)。穷举 `switch`:core 给匹配词加员时这里编译红。
+     */
+    private static singleOfferToolAgrees;
     private static boundRuleOfferTexts;
+    /**
+     * 这张卡的**绑定值**(`prepareCardApproval` 的 `command`,也是耐久行的 `rule_command`)= 引擎为这张卡铸的候选所说的那一形(core 只按卡的规则形铸候选):
+     *  · 候选全是整工具候选(`match: "tool"`,core 7.57.0;至少一只)⇒ `""` —— 整只工具不绑任何值;core 恰在 `command` 是 `""` 时为这类工具铸卡;
+     *  · 其余(命令形候选,或读者把候选丢光了)⇒ 被裁决的命令原字节 `args.command`(非空串;读不出 ⇒ 没有素材)。空候选表不说「整工具」:
+     *    它什么形都没说,绑定值回到调用自己的命令(编辑面兑的就是它)。
+     * 两形混在一张卡上 = 不是 core 铸得出的卡 ⇒ 没有素材(整条车道撤回,与本文件其余撤回臂同形)。`req.args` 窄读,禁裸 as-cast。
+     */
+    private static cardBindingOf;
     private buildRuleLaneMaterial;
     /** [ref]([ref]/[ref] 双属主裁定):把某 wire run 的**流内未决 ask** 立即转 durable park——断连支专用。
      *  匹配键=`ctxTaskId`(wire run id)。该字段的顶注说它「不是清扫判据」——那是因为清扫要判**连接**的

package/dist/tool-approval.js

@@ -3,6 +3,7 @@ import { heldAskOf, liveSettledBy, readDecidedBy, retiredDecisionKeyFacts, DECID
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7, classifyAsk, foldArbitrationRow, policyCannotAnswer, screenAskClassMembers, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
+import { cardTakesWholeToolConsent } from "./permission-rule-vocab.js";
 import { redactDeep, redactSecrets, redactSecretsWithArms } from "./trace/redact.js";
 import { seatText } from "./trace/exit-seat.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -18,10 +19,12 @@ import { APPROVAL_ENDING_CAUSES, SETTLE_OUTCOME, causeOfAskRow } from "./approva
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 import { governanceOriginOf } from "./runtime-governance.js";
-import { callGrantBindingOf, questionGrantBindingOf } from "./standing-answer-grant.js";
+import { grantBindingOf } from "./standing-answer-grant.js";
 import { operatorAsk } from "./operator-ask.js";
 import { APPROVAL_EXEMPTED_EVENT } from "./plugins/approval-exemption-store.js";
 import { refusalBody } from "./http/refusal-body.js";
+import { withoutSettlementEvidence } from "./gate-settlement.js";
+import { extensionRequesterOf } from "./trace/extension-call-face.js";
 const defaultLogger = createLogger();
 const MAX_APPROVAL_ARGS_BYTES = 16384;
 const DEFAULT_APPROVAL_TTL_MS = 5 * 60_000;
@@ -118,7 +121,7 @@ function askStandingAnswerFacts(req, governanceForced, deploymentListAsks) {
         governanceForced,
         requiresRealApproval: req.requiresRealApproval === true,
         mandated: req.mandated === true,
-        grantBinding: questionGrantBindingOf(req, deploymentListQuestion),
+        grantBinding: grantBindingOf(req),
         classes,
         deploymentListQuestion,
     };
@@ -135,7 +138,7 @@ export function policyAskStandingAnswerFacts(req, ask, deploymentListQuestion) {
         governanceForced: false,
         requiresRealApproval: ask.requiresRealApproval === true,
         mandated: ask.mandated === true,
-        grantBinding: callGrantBindingOf(req),
+        grantBinding: grantBindingOf(req),
         classes: [...classifyAsk(ask, noGateFacts({ toolCallId: req.toolCallId, toolName: req.toolName })).classes],
         deploymentListQuestion,
     };
@@ -172,7 +175,7 @@ export function parkRowStandingAnswerFacts(stored, gate, governance, deploymentL
         governanceForced: governanceOriginOf({ riskDescriptor }, governance) === true,
         requiresRealApproval: readParkRowTrueSeat(pending, "requiresRealApproval"),
         mandated: readParkRowTrueSeat(pending, "mandated") || mandatedFromSeat(readRuleOffersAbsenceSeat(pending)),
-        grantBinding: questionGrantBindingOf(pending, deploymentListQuestion),
+        grantBinding: grantBindingOf(pending),
         classes,
         deploymentListQuestion,
     };
@@ -750,7 +753,7 @@ export class ToolApprovalCoordinator {
         };
         if (offer.kind === "single") {
             const d = derive(offer.rule);
-            return d !== undefined && d.rule === offer.rule && d.tool === "Bash" && d.match === offer.match && d.command === offer.command;
+            return d !== undefined && d.rule === offer.rule && d.match === offer.match && d.command === offer.command && ToolApprovalCoordinator.singleOfferToolAgrees(d.match, d.tool);
         }
         return offer.rules.every((m) => {
             const d = derive(m.rule);
@@ -766,6 +769,29 @@ export class ToolApprovalCoordinator {
             }
         });
     }
+    static singleOfferToolAgrees(match, tool) {
+        switch (match) {
+            case "exact":
+            case "prefix":
+            case "wildcard":
+            case "pattern":
+                return tool === "Bash";
+            case "tool":
+                return cardTakesWholeToolConsent(tool);
+            case "subpath":
+            case "path":
+            case "name":
+            case "name_prefix":
+            case "host":
+            case "subdomain":
+                return false;
+            default: {
+                const unknown = match;
+                void unknown;
+                return false;
+            }
+        }
+    }
     static boundRuleOfferTexts(offers) {
         const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
         const clipSegment = (s) => (over(s) ? s.slice(0, MAX_RULE_TEXT_CHARS) : s);
@@ -812,6 +838,17 @@ export class ToolApprovalCoordinator {
         }
         return out;
     }
+    static cardBindingOf(args, offers) {
+        const isWholeTool = (o) => o.kind === "single" && o.match === "tool";
+        if (offers.length > 0 && offers.every(isWholeTool))
+            return "";
+        if (offers.some(isWholeTool))
+            return undefined;
+        if (args === null || typeof args !== "object" || Array.isArray(args))
+            return undefined;
+        const command = args.command;
+        return typeof command === "string" && command !== "" ? command : undefined;
+    }
     buildRuleLaneMaterial(req, owner, governanceForced, sessionId) {
         if (this.ruleConsent === undefined)
             return undefined;
@@ -826,11 +863,8 @@ export class ToolApprovalCoordinator {
         const offers = ToolApprovalCoordinator.boundRuleOfferTexts(capped);
         if (offers === undefined)
             return undefined;
-        const args = req.args;
-        if (args === null || typeof args !== "object" || Array.isArray(args))
-            return undefined;
-        const command = args.command;
-        if (typeof command !== "string" || command === "")
+        const command = ToolApprovalCoordinator.cardBindingOf(req.args, offers);
+        if (command === undefined)
             return undefined;
         const boundInputHash = readBoundInputHash(req);
         const scopeRoot = this.ruleScopeRootFor?.(sessionId);
@@ -1295,6 +1329,7 @@ export class ToolApprovalCoordinator {
         const cardWord = readApprovalCard(req.approvalCard);
         const originWord = typeof req.origin === "string" && req.origin.length > 0 ? req.origin : undefined;
         const askClassPair = readAskClassPair(req);
+        const requester = extensionRequesterOf(req.requestedBy, "tool_approval");
         const frame = {
             type: "tool_approval",
             approvalId: id,
@@ -1328,6 +1363,7 @@ export class ToolApprovalCoordinator {
             ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
             ...(originWord !== undefined ? { origin: originWord } : {}),
             ...(askClassPair ?? {}),
+            ...(requester !== undefined ? { requestedBy: requester } : {}),
             ...((d) => (d !== undefined ? { allowRuleShadowed: d } : {}))(readAllowRuleShadowed(req)),
             ...(ruleLaneMaterial !== undefined ? { ruleOffers: ruleLaneMaterial.offers } : {}),
             ...((a) => (a !== undefined ? { ruleOffersAbsence: a } : {}))(readRuleOffersAbsence(req)),
@@ -1861,7 +1897,7 @@ export class ToolApprovalCoordinator {
         }
         const entryClasses = askClassPair?.classes;
         const entryDeploymentListQuestion = carriesDeploymentListQuestion(deploymentListAsks, entryClasses);
-        const entryGrantBinding = questionGrantBindingOf(req, entryDeploymentListQuestion);
+        const entryGrantBinding = grantBindingOf(req);
         const rememberRefused = standingAnswerHome(pendingEntryStandingAnswerFacts({
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
@@ -2586,10 +2622,11 @@ export class ToolApprovalCoordinator {
             if (fresh?.terminal === true && memo.redeemed !== undefined)
                 memo.redeemed.rule = fresh.body;
         }
+        const sameDecision = (parsed.value === "deny") === (receipt.decision === "deny");
         return {
             status: 200,
             body: {
-                ...receipt.body,
+                ...(sameDecision ? receipt.body : withoutSettlementEvidence(receipt.body)),
                 approvalId: id,
                 askId: row.askId,
                 accepted: "parked_redeemed",

package/dist/trace/core-keyset-guard.d.ts

@@ -44,8 +44,8 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "approvalCard" | "boundGrantAbsence";
-type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy" | "requestedBy" | "editRewritten";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "approvalCard" | "boundGrantAbsence" | "requestedBy";
+type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy" | "editRewritten";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
 type AskFrameServerMinted = "type" | "approvalId" | "argsOmitted" | "outcome" | "governanceForced" | "expiresAtMs" | "expiresInMs" | "serverNowMs" | "parked" | "cause" | "inputHasBidi" | "rememberRefused";
@@ -54,10 +54,10 @@ type _GuardAskFrameReverse = AssertAllKeysHandled<Exclude<AskProjected | AskFram
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta" | "tool_progress" | "tool_disclosure" | "task_started" | "compaction_started";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
 type _GuardTaskEventReverse = AssertAllKeysHandled<Exclude<TaskEventHandled, TaskEvent["type"]>>;
-type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
+type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain" | "peerMeta" | "decision" | "id";
 type _GuardMailbox = AssertAllKeysHandled<Exclude<keyof MailboxMessage, MailboxProjected>>;
 type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof MailboxMessage>>;
-type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
+type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta" | "id";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
 type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "mods" | "lsp" | "hands" | "writeProtection" | "teamRole" | "fileHistory" | "permissionMode" | "sessionRules" | "projectMemory";
@@ -66,10 +66,11 @@ type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, W
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
 type WiringSection<K extends keyof WiringManifest> = NonNullable<WiringManifest[K]>;
 type WiringLegHandled = "kind";
-type _GuardWiringLeg = AssertAllKeysHandled<Exclude<keyof WiringSection<"leg">, WiringLegHandled>>;
-type _GuardWiringLegReverse = AssertAllKeysHandled<Exclude<WiringLegHandled, keyof WiringSection<"leg">>>;
+type WiringLegExcluded = "runOrigin";
+type _GuardWiringLeg = AssertAllKeysHandled<Exclude<keyof WiringSection<"leg">, WiringLegHandled | WiringLegExcluded>>;
+type _GuardWiringLegReverse = AssertAllKeysHandled<Exclude<WiringLegHandled | WiringLegExcluded, keyof WiringSection<"leg">>>;
 type WiringModRowKeys = WiringSection<"mods">[number] extends infer R ? (R extends unknown ? keyof R : never) : never;
-type WiringModRowHandled = "name" | "seat" | "tier" | "events" | "observe" | "skipped" | "refusedBy" | "reason";
+type WiringModRowHandled = "name" | "seat" | "tier" | "provenance" | "events" | "observe" | "skipped" | "refusedBy" | "reason";
 type _GuardWiringModRow = AssertAllKeysHandled<Exclude<WiringModRowKeys, WiringModRowHandled>>;
 type _GuardWiringModRowReverse = AssertAllKeysHandled<Exclude<WiringModRowHandled, WiringModRowKeys>>;
 type WiringModSkipKeys = keyof NonNullable<Extract<WiringSection<"mods">[number], {
@@ -108,7 +109,11 @@ type _GuardSubagentTranscriptTierWords = AssertAllKeysHandled<Exclude<SubagentTr
 type _GuardSubagentTranscriptTierWordsReverse = AssertAllKeysHandled<Exclude<SubagentTranscriptTierWords, SubagentTranscriptTier>>;
 type WiringMcpEntry = WiringSection<"mcp">[number];
 type WiringMcpExcluded = "error";
-type WiringMcpHandled = "name" | "source" | "status" | "errorCode" | "delivered" | "httpStatus" | "toolCount" | "liveness" | WiringMcpExcluded;
+type WiringMcpHandled = "name" | "source" | "status" | "errorCode" | "delivered" | "httpStatus" | "toolCount" | "liveness" | "authorization" | WiringMcpExcluded;
+type McpAuthorizationRecord = NonNullable<WiringMcpEntry["authorization"]>;
+type McpAuthorizationTables = typeof import("../mcp-authorization-face.js");
+type _GuardMcpAuthorization = AssertAllKeysHandled<Exclude<keyof McpAuthorizationRecord, TableCoreKeys<McpAuthorizationTables["MCP_AUTHORIZATION_DISPOSITIONS"]>>>;
+type _GuardMcpAuthorizationReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<McpAuthorizationTables["MCP_AUTHORIZATION_DISPOSITIONS"]>, keyof McpAuthorizationRecord>>;
 type _GuardWiringMcp = AssertAllKeysHandled<Exclude<keyof WiringMcpEntry, WiringMcpHandled>>;
 type _GuardWiringMcpReverse = AssertAllKeysHandled<Exclude<WiringMcpHandled, keyof WiringMcpEntry>>;
 type WiringMcpLiveness = NonNullable<WiringMcpEntry["liveness"]>;
@@ -212,27 +217,27 @@ type _GuardPromptManifestKeysNonEmpty = AssertAllKeysHandled<{
     [L in keyof ManifestCore]: [ManifestDeclared<ManifestFaces, L>] extends [never] ? L : never;
 }[keyof ManifestCore]>;
 type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence" | "checkpointId";
-type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "approvalCard" | "restoreMode" | "previewWithheld" | "authoredBy";
+type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "approvalCard" | "restoreMode" | "previewWithheld" | "authoredBy" | "runOrigin" | "requestedByCallId";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
 type ParkArmKeys = keyof Extract<PendingAction, {
     kind: "tool_approval";
 }>;
 type ParkArmQueueProjected = "toolName" | "toolCallId" | "boundInputHash" | "ruleOffers" | "hasBidiControls" | keyof import("../approval-card.js").ParkRowFacts | keyof import("../approval-card.js").SkillCardFacts;
-type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "family" | "pathTarget" | "hostTarget" | "targets" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "engineMounted";
+type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "family" | "pathTarget" | "hostTarget" | "targets" | "targetReads" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "engineMounted" | "declarationDigest";
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptRole" | "promptBinding" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptLean" | "toolPolicy" | "onAsk" | "onQuestion" | "mods" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "projectMemory" | "allowedTools" | "allowTools" | "userAttachments" | "readDenyPatterns" | "writeProtectedAdditions" | "complianceAdditionalDenies";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptRole" | "promptBinding" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptLean" | "toolPolicy" | "onAsk" | "onQuestion" | "mods" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "projectMemory" | "allowedTools" | "allowTools" | "userAttachments" | "readDenyPatterns" | "writeProtectedAdditions" | "complianceAdditionalDenies" | "projectId";
 /** 导出:请求体键闭集门(`request-key-closure.ts`)据它锁「本仓记为未接线的引擎座,提交口不许受理」—— 两处分类只能同向。 */
-export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "modelRole" | "enableBlockedReport" | "promptForm" | "advisorModel";
+export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "modelRole" | "enableBlockedReport" | "promptForm" | "advisorModel" | "runOrigin" | "planFile" | "classifyAllShell";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction" | "resultEntryIds";
 type TaskResultStripped = never;
 type _GuardTaskResult = AssertAllKeysHandled<Exclude<keyof TaskResult, TaskResultForwarded | TaskResultStripped>>;
 type _GuardTaskResultReverse = AssertAllKeysHandled<Exclude<TaskResultForwarded | TaskResultStripped, keyof TaskResult>>;
-type PausedCauseForwarded = "kind" | "gate" | "checkpointId" | "restoreMode";
+type PausedCauseForwarded = "kind" | "gate" | "checkpointId" | "restoreMode" | "requestedByCallId";
 type PausedCauseStripped = "token";
 type _GuardPausedCause = AssertAllKeysHandled<Exclude<keyof PausedCause, PausedCauseForwarded | PausedCauseStripped>>;
 type _GuardPausedCauseReverse = AssertAllKeysHandled<Exclude<PausedCauseForwarded | PausedCauseStripped, keyof PausedCause>>;
@@ -247,7 +252,7 @@ type SessionMemoryStatusProjected = "captureOptedOut" | "committedCount" | "fold
 type SessionMemoryStatusExcluded = "writeHome";
 type _GuardSessionMemoryStatus = AssertAllKeysHandled<Exclude<keyof SessionMemoryStatus, SessionMemoryStatusProjected | SessionMemoryStatusExcluded>>;
 type _GuardSessionMemoryStatusReverse = AssertAllKeysHandled<Exclude<SessionMemoryStatusProjected | SessionMemoryStatusExcluded, keyof SessionMemoryStatus>>;
-type SideQueryResultForwarded = "text" | "toolCalls" | "model" | "servedModel" | "degraded" | "responseModel" | "usage" | "usageMissing" | "stopReason" | "errorMessage" | "errorCode" | "errorKind" | "inputTooLongRuledOut";
+type SideQueryResultForwarded = "text" | "toolCalls" | "model" | "servedModel" | "degraded" | "responseModel" | "usage" | "usageMissing" | "stopReason" | "errorMessage" | "errorCode" | "errorKind" | "inputTooLongRuledOut" | "account";
 type SideQueryResultStripped = never;
 type _GuardSideQueryResult = AssertAllKeysHandled<Exclude<keyof SideQueryResult, SideQueryResultForwarded | SideQueryResultStripped>>;
 type _GuardSideQueryResultReverse = AssertAllKeysHandled<Exclude<SideQueryResultForwarded | SideQueryResultStripped, keyof SideQueryResult>>;
@@ -261,7 +266,7 @@ type GateOutcomeProjected = "disposition" | "settlement" | "origin";
 type _GuardGateOutcome = AssertAllKeysHandled<Exclude<keyof GateOutcome, GateOutcomeProjected>>;
 type _GuardGateOutcomeReverse = AssertAllKeysHandled<Exclude<GateOutcomeProjected, keyof GateOutcome>>;
 type GateDispositionKeys = GateDisposition extends infer D ? (D extends object ? keyof D : never) : never;
-type GateDispositionProjected = "kind" | "deniedBy" | "cause" | "classifier" | "released" | "clearedBy" | "mode" | "askClass" | "classes";
+type GateDispositionProjected = "kind" | "deniedBy" | "cause" | "classifier" | "released" | "clearedBy" | "mode" | "askClass" | "classes" | "extension";
 type _GuardGateDisposition = AssertAllKeysHandled<Exclude<GateDispositionKeys, GateDispositionProjected>>;
 type _GuardGateDispositionReverse = AssertAllKeysHandled<Exclude<GateDispositionProjected, GateDispositionKeys>>;
 type SettlementProjected = "kind" | "who" | "when" | "note";
@@ -301,12 +306,12 @@ type McpReconnectWithheld = "axes" | "dropped" | "warnings";
 type _GuardMcpReconnect = AssertAllKeysHandled<Exclude<keyof McpReconnectResult, McpReconnectProjected | McpReconnectWithheld>>;
 type _NoDoubleBookMcpReconnect = AssertAllKeysHandled<Extract<McpReconnectProjected, McpReconnectWithheld>>;
 type _GuardMcpReconnectReverse = AssertAllKeysHandled<Exclude<McpReconnectProjected | McpReconnectWithheld, keyof McpReconnectResult>>;
-type McpRedialStatusProjected = "name" | "status" | "errorCode" | "httpStatus" | "delivered" | "serverInfo" | "error" | "transportClosed";
+type McpRedialStatusProjected = "name" | "status" | "errorCode" | "httpStatus" | "delivered" | "authorization" | "serverInfo" | "error" | "transportClosed";
 type McpRedialStatusWithheld = "toolNames" | "liveness";
 type _GuardMcpRedialStatus = AssertAllKeysHandled<Exclude<keyof McpServerStatus, McpRedialStatusProjected | McpRedialStatusWithheld>>;
 type _NoDoubleBookMcpRedialStatus = AssertAllKeysHandled<Extract<McpRedialStatusProjected, McpRedialStatusWithheld>>;
 type _GuardMcpRedialStatusReverse = AssertAllKeysHandled<Exclude<McpRedialStatusProjected | McpRedialStatusWithheld, keyof McpServerStatus>>;
-type McpPanelStatusProjected = "name" | "status" | "serverInfo" | "toolNames" | "error";
+type McpPanelStatusProjected = "name" | "status" | "serverInfo" | "toolNames" | "error" | "authorization";
 type McpPanelStatusWithheld = "errorCode" | "httpStatus" | "delivered" | "transportClosed" | "liveness";
 type _GuardMcpPanelStatus = AssertAllKeysHandled<Exclude<keyof McpServerStatus, McpPanelStatusProjected | McpPanelStatusWithheld>>;
 type _NoDoubleBookMcpPanelStatus = AssertAllKeysHandled<Extract<McpPanelStatusProjected, McpPanelStatusWithheld>>;
@@ -323,6 +328,12 @@ type _NoDoubleBookLspOptions = AssertAllKeysHandled<Extract<LspOptionsWired, Lsp
 /** ⑯ 账上记过、已接线的 `RunnerDeps` 席([ref] 起 `fileHistoryCapture`)。反向钉:core 改名 / 退役 ⇒ 红。 */
 type RunnerDepsLedgerWired = "fileHistoryCapture";
 type _GuardLedgerRunnerDepsReverse = AssertAllKeysHandled<Exclude<RunnerDepsLedgerWired, keyof RunnerDeps>>;
+type SessionWorkspaceTables = typeof import("../session-workspace.js");
+type WorkspaceChangedArm = Extract<TaskEvent, {
+    type: "workspace_changed";
+}>;
+type _GuardSessionWorkspace = AssertAllKeysHandled<Exclude<keyof WorkspaceChangedArm, TableCoreKeys<SessionWorkspaceTables["SESSION_WORKSPACE_DISPOSITIONS"]>>>;
+type _GuardSessionWorkspaceReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<SessionWorkspaceTables["SESSION_WORKSPACE_DISPOSITIONS"]>, keyof WorkspaceChangedArm>>;
 export type CoreKeysetGuards = [
     _GuardNotification,
     _GuardTerminalArm,
@@ -384,6 +395,8 @@ export type CoreKeysetGuards = [
     _GuardWiringModSkipReverse,
     _GuardWiringMcp,
     _GuardWiringMcpReverse,
+    _GuardMcpAuthorization,
+    _GuardMcpAuthorizationReverse,
     _GuardWiringRules,
     _GuardWiringRulesReverse,
     _GuardWiringModelGate,
@@ -463,7 +476,9 @@ export type CoreKeysetGuards = [
     _GuardLspOptions,
     _NoDoubleBookLspOptions,
     _GuardLspOptionsReverse,
-    _GuardLedgerRunnerDepsReverse
+    _GuardLedgerRunnerDepsReverse,
+    _GuardSessionWorkspace,
+    _GuardSessionWorkspaceReverse
 ];
 export {};
 //# sourceMappingURL=core-keyset-guard.d.ts.map

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.image_removed", "mcp.authorization_required"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;

package/dist/trace/engine-notice-wire.js

@@ -46,6 +46,8 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "advisor.not_attached",
     "inherit_env.names_withheld",
     "model.capability_downgraded",
+    "context.image_removed",
+    "mcp.authorization_required",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {

package/dist/trace/exit-seat.d.ts

@@ -13,7 +13,14 @@ export type SafeText = string & {
  *  · `operator-log-arg`:运维日志字段里模型写的工具入参(`tool_trace` 的 `arg.*`:路径 / 命令 / 模式 / 非对象入参的串形);界 120 码元(含截断记号);
  *  · `operator-log-error`:运维日志字段里 hook 一侧的报错 —— hook 命令的 stderr、prompt 条目的载体失败句、起子进程 / 读会话分支抛出的句子;界 300 码元(含截断记号);
  *  · `operator-log-message`:运维日志字段里写给人看的一段话 —— hook 输出的 `systemMessage`、Stop 评估者判「做不到」的理由;界 500 码元(含截断记号);
- *  · `session-title`:自动标题器落行的会话标题(落库 / 列表面 / `session_titled` 帧同一份);界 80 码元(含截断记号),在 `title` 列宽之内。
+ *  · `session-title`:自动标题器落行的会话标题(落库 / 列表面 / `session_titled` 帧同一份);界 80 码元(含截断记号),在 `title` 列宽之内;
+ *  · `mcp-remote-text`:MCP 远端失败句(远端可控自由文本,租户面)—— `GET /v1/sessions/:id/mcp` 面板的 `servers[].error` 与 `POST /v1/sessions/:id/mcp/reconnect`
+ *    的 `reason` / `status.error` / `listingIncomplete.error`;引擎铸点已抹过请求回显与同主体词表(记号 `[redacted]`),这一行读同一个脱敏器(引擎记号 = 已抹的值,
+ *    引擎放过的形照抹);界 200 码元,原样出门(JSON 串值,消费方自己渲染)。
+ *  · `peer-declaration-sentence`:引擎判官对一份 MCP / A2A 对端声明说的句子(`toolAxes` / `toolFaces` / `sessionMetaKey` / 启动界的原因句,逐字带着声明方写的工具名、键名),
+ *    进请求面 400 拒句、续跑重放的丢弃行与重读行、名册的跳过行 —— 读者是调用方与运维,句子已是一行;不设界(拒句要说全判官的话),原样出门。
+ *  · `boot-refusal-line`:起服拒启的一行拒句 —— 部署座装配的拒句(`mods-declaration.ts`:声明的席名、包名、读包者 / 引擎准入交回的话);它经进程级 fatal 出口原样多行进 stderr,
+ *    所以必须在这里先压成一行(一句拒因里的换行会在运维的终端里伪造出第二条日志行);界 512 码元(含截断记号)。
  */
 declare const EXIT_SEATS: {
     readonly "trace-frame-text": {
@@ -48,6 +55,18 @@ declare const EXIT_SEATS: {
         readonly maxChars: 80;
         readonly emit: "title-line";
     };
+    readonly "mcp-remote-text": {
+        readonly scope: "free-text";
+        readonly maxChars: 200;
+    };
+    readonly "peer-declaration-sentence": {
+        readonly scope: "free-text";
+    };
+    readonly "boot-refusal-line": {
+        readonly scope: "free-text";
+        readonly maxChars: 512;
+        readonly emit: "log-line";
+    };
 };
 export type ExitSeat = keyof typeof EXIT_SEATS;
 /** 设了界的座名。 */

package/dist/trace/exit-seat.js

@@ -12,6 +12,9 @@ const EXIT_SEATS = {
     "operator-log-error": { scope: "free-text", maxChars: 300, emit: "log-line" },
     "operator-log-message": { scope: "free-text", maxChars: 500, emit: "log-line" },
     "session-title": { scope: "free-text", maxChars: 80, emit: "title-line" },
+    "mcp-remote-text": { scope: "free-text", maxChars: 200 },
+    "peer-declaration-sentence": { scope: "free-text" },
+    "boot-refusal-line": { scope: "free-text", maxChars: 512, emit: "log-line" },
 };
 export function seatMaxChars(seat) {
     return EXIT_SEATS[seat].maxChars;

package/dist/trace/extension-call-face.d.ts

@@ -0,0 +1,33 @@
+/**
+ * 扩展自己发起 / 代答 / 改写的工具调用在 wire 上的三位 —— `requestedBy`(谁要的这只调用)、`answeredBy`(哪张注册在 `tool.call` 上代替工具体作答)与
+ * `tool_end.rewrite`(门放行时交给工具体的参数不是它收进来的那份:放行的那份 + 谁改的)的**唯一读法**。
+ *
+ * 引擎的事实(core `ExtensionRequester` / `tool_end.answeredBy`):一张注册经 `$.tool.call` 发起的调用,`tool_start` / `tool_end` 与审批卡都带
+ * `requestedBy: { kind: "extension", name }`(模型消息带来的调用上缺席);注册在 `tool.call` 站上以自己的结果或拒答代替工具体时,`tool_end` 带
+ * `answeredBy: <注册名>`(旁边恒有 `notExecuted: true`)。本仓的部署座装上运维声明的包之后,这两位真能到达 —— 投影它们。
+ *
+ * 读法(写腿与读腿、帧与卡同一只):
+ *  · 注册名是**注册方定的串** ⇒ 过 {@link sanitizeWireText}(与 `wiring_manifest.mods[]` 的 `name`、通告 `mods.registration_refused` 同一只出口纪律),
+ *    同一张注册在三处的名逐字节相等;
+ *  · 形不对(`kind` 不是 `"extension"`、`name` 不是非空串、`answeredBy` 不是非空串)⇒ 丢这一位、计一次 `server.trace.projection-input-malformed`
+ *    (纯归因位:半张归因比没有更坏,不修补);缺席 = 没有这件事(正面事实),不计;
+ *  · `rewrite`(引擎 7.58.0 `ToolInputRewrite`)整只一位:`by` 每项是改写者(扩展项的注册名同上过出口纪律;`policy` / `approver` 两项无成员),`input` 是工具参数
+ *    (模型 / 扩展 / 审批人写的)⇒ 经调用方交进来的工具参数投影 —— 与 `tool_start.args` 同一只(`trace/project.ts` 的那一只;本文件不自己答脱敏);
+ *    `by` 不是非空数组、有一项不在三形里、缺 `input` ⇒ 整只丢 + 计一次。
+ *    续跑腿的帧引擎不带它(引擎的未覆盖面),本读法不补。
+ */
+import type { ExtensionRequester, RewriteAuthor } from "@sema-agent/core";
+/** wire 上的发起者位 = 引擎的 `ExtensionRequester` 同形(`name` 已过出口纪律);引擎加一类发起者 ⇒ 这里的形随之,读法下面一处判。 */
+export type ExtensionRequesterFace = Readonly<ExtensionRequester>;
+/** `requestedBy` 的投影(缺席 ⇒ 缺席;形不对 ⇒ 丢 + 计一次)。`where` 进留痕句(哪一面:`tool_start` / `tool_end` / `tool_approval` / 读腿)。 */
+export declare function extensionRequesterOf(v: unknown, where: string): ExtensionRequesterFace | undefined;
+/** `answeredBy` 的投影(缺席 ⇒ 缺席;形不对 ⇒ 丢 + 计一次)。 */
+export declare function extensionAnswererOf(v: unknown, where: string): string | undefined;
+/** wire 上的改写记录 = 引擎的 `ToolInputRewrite` 同形(扩展项的 `name` 已过出口纪律、`input` 已脱敏)。 */
+export interface ToolInputRewriteFace {
+    readonly by: readonly Readonly<RewriteAuthor>[];
+    readonly input: unknown;
+}
+/** `tool_end.rewrite` 的投影(缺席 ⇒ 缺席;形不对 ⇒ 整只丢 + 计一次)。`argsOnWire` = 工具参数上 wire 的那一只投影(与 `tool_start.args` 同一只,调用方交进来)。 */
+export declare function toolInputRewriteOf(v: unknown, where: string, argsOnWire: (args: unknown) => unknown): ToolInputRewriteFace | undefined;
+//# sourceMappingURL=extension-call-face.d.ts.map

package/dist/trace/extension-call-face.js

@@ -0,0 +1,39 @@
+import { sanitizeWireText } from "./engine-notice-wire.js";
+import { dropProjectedFace } from "./projection-drop.js";
+export function extensionRequesterOf(v, where) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v === "object" && v !== null && "kind" in v && "name" in v && v.kind === "extension" && typeof v.name === "string" && v.name !== "")
+        return { kind: "extension", name: sanitizeWireText(v.name) };
+    return dropProjectedFace("extension_call.requestedBy is not { kind: extension, name: <non-empty string> } on " + where);
+}
+export function extensionAnswererOf(v, where) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v === "string" && v !== "")
+        return sanitizeWireText(v);
+    return dropProjectedFace("extension_call.answeredBy is not a non-empty string on " + where);
+}
+const REWRITE_AUTHOR_READERS = {
+    extension: (v) => ("name" in v && typeof v.name === "string" && v.name !== "" ? { kind: "extension", name: sanitizeWireText(v.name) } : undefined),
+    policy: () => ({ kind: "policy" }),
+    approver: () => ({ kind: "approver" }),
+};
+const isRewriteAuthorKind = (kind) => typeof kind === "string" && Object.hasOwn(REWRITE_AUTHOR_READERS, kind);
+function rewriteAuthorOf(v) {
+    if (typeof v !== "object" || v === null || !("kind" in v))
+        return undefined;
+    const kind = v.kind;
+    return isRewriteAuthorKind(kind) ? REWRITE_AUTHOR_READERS[kind](v) : undefined;
+}
+export function toolInputRewriteOf(v, where, argsOnWire) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v === "object" && v !== null && "by" in v && "input" in v && Array.isArray(v.by) && v.by.length > 0) {
+        const by = Array.from(v.by, rewriteAuthorOf);
+        if (by.every((a) => a !== undefined))
+            return { by, input: argsOnWire(v.input) };
+    }
+    return dropProjectedFace("tool_end.rewrite is not { by: <non-empty list of extension / policy / approver>, input } on " + where);
+}
+//# sourceMappingURL=extension-call-face.js.map