@sema-agent/server 7.137.0 → 7.139.0

package/dist/tool-approval.js

@@ -3,6 +3,7 @@ import { heldAskOf, liveSettledBy, readDecidedBy, retiredDecisionKeyFacts, DECID
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7, classifyAsk, foldArbitrationRow, policyCannotAnswer, screenAskClassMembers, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
+import { cardTakesWholeToolConsent } from "./permission-rule-vocab.js";
 import { redactDeep, redactSecrets, redactSecretsWithArms } from "./trace/redact.js";
 import { seatText } from "./trace/exit-seat.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -18,10 +19,12 @@ import { APPROVAL_ENDING_CAUSES, SETTLE_OUTCOME, causeOfAskRow } from "./approva
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 import { governanceOriginOf } from "./runtime-governance.js";
-import { callGrantBindingOf, questionGrantBindingOf } from "./standing-answer-grant.js";
+import { grantBindingOf } from "./standing-answer-grant.js";
 import { operatorAsk } from "./operator-ask.js";
 import { APPROVAL_EXEMPTED_EVENT } from "./plugins/approval-exemption-store.js";
 import { refusalBody } from "./http/refusal-body.js";
+import { withoutSettlementEvidence } from "./gate-settlement.js";
+import { extensionRequesterOf } from "./trace/extension-call-face.js";
 const defaultLogger = createLogger();
 const MAX_APPROVAL_ARGS_BYTES = 16384;
 const DEFAULT_APPROVAL_TTL_MS = 5 * 60_000;
@@ -118,7 +121,7 @@ function askStandingAnswerFacts(req, governanceForced, deploymentListAsks) {
         governanceForced,
         requiresRealApproval: req.requiresRealApproval === true,
         mandated: req.mandated === true,
-        grantBinding: questionGrantBindingOf(req, deploymentListQuestion),
+        grantBinding: grantBindingOf(req),
         classes,
         deploymentListQuestion,
     };
@@ -135,7 +138,7 @@ export function policyAskStandingAnswerFacts(req, ask, deploymentListQuestion) {
         governanceForced: false,
         requiresRealApproval: ask.requiresRealApproval === true,
         mandated: ask.mandated === true,
-        grantBinding: callGrantBindingOf(req),
+        grantBinding: grantBindingOf(req),
         classes: [...classifyAsk(ask, noGateFacts({ toolCallId: req.toolCallId, toolName: req.toolName })).classes],
         deploymentListQuestion,
     };
@@ -172,7 +175,7 @@ export function parkRowStandingAnswerFacts(stored, gate, governance, deploymentL
         governanceForced: governanceOriginOf({ riskDescriptor }, governance) === true,
         requiresRealApproval: readParkRowTrueSeat(pending, "requiresRealApproval"),
         mandated: readParkRowTrueSeat(pending, "mandated") || mandatedFromSeat(readRuleOffersAbsenceSeat(pending)),
-        grantBinding: questionGrantBindingOf(pending, deploymentListQuestion),
+        grantBinding: grantBindingOf(pending),
         classes,
         deploymentListQuestion,
     };
@@ -750,7 +753,7 @@ export class ToolApprovalCoordinator {
         };
         if (offer.kind === "single") {
             const d = derive(offer.rule);
-            return d !== undefined && d.rule === offer.rule && d.tool === "Bash" && d.match === offer.match && d.command === offer.command;
+            return d !== undefined && d.rule === offer.rule && d.match === offer.match && d.command === offer.command && ToolApprovalCoordinator.singleOfferToolAgrees(d.match, d.tool);
         }
         return offer.rules.every((m) => {
             const d = derive(m.rule);
@@ -766,6 +769,29 @@ export class ToolApprovalCoordinator {
             }
         });
     }
+    static singleOfferToolAgrees(match, tool) {
+        switch (match) {
+            case "exact":
+            case "prefix":
+            case "wildcard":
+            case "pattern":
+                return tool === "Bash";
+            case "tool":
+                return cardTakesWholeToolConsent(tool);
+            case "subpath":
+            case "path":
+            case "name":
+            case "name_prefix":
+            case "host":
+            case "subdomain":
+                return false;
+            default: {
+                const unknown = match;
+                void unknown;
+                return false;
+            }
+        }
+    }
     static boundRuleOfferTexts(offers) {
         const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
         const clipSegment = (s) => (over(s) ? s.slice(0, MAX_RULE_TEXT_CHARS) : s);
@@ -812,6 +838,17 @@ export class ToolApprovalCoordinator {
         }
         return out;
     }
+    static cardBindingOf(args, offers) {
+        const isWholeTool = (o) => o.kind === "single" && o.match === "tool";
+        if (offers.length > 0 && offers.every(isWholeTool))
+            return "";
+        if (offers.some(isWholeTool))
+            return undefined;
+        if (args === null || typeof args !== "object" || Array.isArray(args))
+            return undefined;
+        const command = args.command;
+        return typeof command === "string" && command !== "" ? command : undefined;
+    }
     buildRuleLaneMaterial(req, owner, governanceForced, sessionId) {
         if (this.ruleConsent === undefined)
             return undefined;
@@ -826,11 +863,8 @@ export class ToolApprovalCoordinator {
         const offers = ToolApprovalCoordinator.boundRuleOfferTexts(capped);
         if (offers === undefined)
             return undefined;
-        const args = req.args;
-        if (args === null || typeof args !== "object" || Array.isArray(args))
-            return undefined;
-        const command = args.command;
-        if (typeof command !== "string" || command === "")
+        const command = ToolApprovalCoordinator.cardBindingOf(req.args, offers);
+        if (command === undefined)
             return undefined;
         const boundInputHash = readBoundInputHash(req);
         const scopeRoot = this.ruleScopeRootFor?.(sessionId);
@@ -981,7 +1015,7 @@ export class ToolApprovalCoordinator {
     }
     boundUnattendedAsk = (identity, why) => {
         return async (req) => {
-            const origin = { owner: identity.owner, taskId: identity.taskId, ...(identity.sessionId !== undefined ? { sessionId: identity.sessionId } : {}), legKey: "" };
+            const origin = { owner: identity.owner, taskId: identity.taskId, ...(identity.sessionId !== undefined ? { sessionId: identity.sessionId } : {}), legKey: "", executionLane: identity.executionLane };
             if (await this.standingGrantSettles(origin, req, this.governanceForcedOf(origin, req)))
                 return true;
             return this.unattendedAskOutcome({ ...why, taskId: identity.taskId, owner: identity.owner, toolName: req.toolName });
@@ -1233,6 +1267,7 @@ export class ToolApprovalCoordinator {
             owner: ctx.owner,
             ...(ctx.sessionId !== undefined ? { sessionId: ctx.sessionId } : {}),
             legKey: ctx.legKey ?? "",
+            executionLane: ctx.executionLane,
             ...(ctx.legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic: ctx.legDeadlineMonotonic } : {}),
         }, [ctx], req, signal);
     };
@@ -1245,6 +1280,7 @@ export class ToolApprovalCoordinator {
                 owner: identity.owner,
                 ...(identity.sessionId !== undefined ? { sessionId: identity.sessionId } : {}),
                 legKey: identity.legKey ?? "",
+                executionLane: identity.executionLane,
                 ...(identity.legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic: identity.legDeadlineMonotonic } : {}),
             }, live, req, signal);
         };
@@ -1295,6 +1331,7 @@ export class ToolApprovalCoordinator {
         const cardWord = readApprovalCard(req.approvalCard);
         const originWord = typeof req.origin === "string" && req.origin.length > 0 ? req.origin : undefined;
         const askClassPair = readAskClassPair(req);
+        const requester = extensionRequesterOf(req.requestedBy, "tool_approval");
         const frame = {
             type: "tool_approval",
             approvalId: id,
@@ -1328,6 +1365,7 @@ export class ToolApprovalCoordinator {
             ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
             ...(originWord !== undefined ? { origin: originWord } : {}),
             ...(askClassPair ?? {}),
+            ...(requester !== undefined ? { requestedBy: requester } : {}),
             ...((d) => (d !== undefined ? { allowRuleShadowed: d } : {}))(readAllowRuleShadowed(req)),
             ...(ruleLaneMaterial !== undefined ? { ruleOffers: ruleLaneMaterial.offers } : {}),
             ...((a) => (a !== undefined ? { ruleOffersAbsence: a } : {}))(readRuleOffersAbsence(req)),
@@ -1347,6 +1385,7 @@ export class ToolApprovalCoordinator {
         const card = this.askStore ? buildApprovalCard(frame, req, req.requiresRealApproval === true) : undefined;
         let cardForFrame = card;
         let persistedExpiresAtMs = expiresAtMs;
+        let entryExecutionLane = origin.executionLane;
         let lateEnsuredRow;
         let lateTerminalRow;
         let abandonedAs;
@@ -1386,6 +1425,7 @@ export class ToolApprovalCoordinator {
                     sourceTaskId,
                     sessionId: origin.sessionId ?? origin.taskId,
                     owner: origin.owner,
+                    executionLane: origin.executionLane,
                     batchId,
                     toolCallId: req.toolCallId,
                     legKey,
@@ -1422,6 +1462,7 @@ export class ToolApprovalCoordinator {
                     return existingOrCreated.inserted ? this.landUnattendedOutcome(unattended, existingOrCreated.row) : unattended;
                 }
                 persistedExpiresAtMs = existingOrCreated.row.expiresAtMs;
+                entryExecutionLane = existingOrCreated.row.executionLane;
                 cardForFrame = persistedEnvelope.card;
                 if (cardForFrame.governanceForced === true)
                     frame.governanceForced = true;
@@ -1861,7 +1902,7 @@ export class ToolApprovalCoordinator {
         }
         const entryClasses = askClassPair?.classes;
         const entryDeploymentListQuestion = carriesDeploymentListQuestion(deploymentListAsks, entryClasses);
-        const entryGrantBinding = questionGrantBindingOf(req, entryDeploymentListQuestion);
+        const entryGrantBinding = grantBindingOf(req);
         const rememberRefused = standingAnswerHome(pendingEntryStandingAnswerFacts({
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
@@ -1900,6 +1941,7 @@ export class ToolApprovalCoordinator {
             ...(entryDeploymentListQuestion ? { deploymentListQuestion: true } : {}),
             registeredAtMs: Date.now(),
             expiresAtMs: persistedExpiresAtMs,
+            executionLane: entryExecutionLane,
             ...(ruleLaneMaterial !== undefined ? { ruleLane: ruleLaneMaterial } : {}),
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
@@ -2586,10 +2628,11 @@ export class ToolApprovalCoordinator {
             if (fresh?.terminal === true && memo.redeemed !== undefined)
                 memo.redeemed.rule = fresh.body;
         }
+        const sameDecision = (parsed.value === "deny") === (receipt.decision === "deny");
         return {
             status: 200,
             body: {
-                ...receipt.body,
+                ...(sameDecision ? receipt.body : withoutSettlementEvidence(receipt.body)),
                 approvalId: id,
                 askId: row.askId,
                 accepted: "parked_redeemed",
@@ -2862,6 +2905,7 @@ export class ToolApprovalCoordinator {
             forceParkNow: release,
             settleParkRoute: (cause) => leave({ outcome: SETTLE_OUTCOME.EXPIRED, cause, parked: this.unattendedRoutesToPark }),
             owner: row.owner,
+            executionLane: row.executionLane,
             ...(row.sessionId !== row.taskId ? { sessionId: row.sessionId } : {}),
             ...(card.fromSubagent === true ? { originTaskId: row.sourceTaskId } : {}),
             toolName: card.toolName,

package/dist/trace/core-keyset-guard.d.ts

@@ -44,8 +44,8 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "approvalCard" | "boundGrantAbsence";
-type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy" | "requestedBy" | "editRewritten";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "approvalCard" | "boundGrantAbsence" | "requestedBy";
+type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy" | "editRewritten";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
 type AskFrameServerMinted = "type" | "approvalId" | "argsOmitted" | "outcome" | "governanceForced" | "expiresAtMs" | "expiresInMs" | "serverNowMs" | "parked" | "cause" | "inputHasBidi" | "rememberRefused";
@@ -54,10 +54,10 @@ type _GuardAskFrameReverse = AssertAllKeysHandled<Exclude<AskProjected | AskFram
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta" | "tool_progress" | "tool_disclosure" | "task_started" | "compaction_started";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
 type _GuardTaskEventReverse = AssertAllKeysHandled<Exclude<TaskEventHandled, TaskEvent["type"]>>;
-type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
+type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain" | "peerMeta" | "decision" | "id";
 type _GuardMailbox = AssertAllKeysHandled<Exclude<keyof MailboxMessage, MailboxProjected>>;
 type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof MailboxMessage>>;
-type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
+type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta" | "id";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
 type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "mods" | "lsp" | "hands" | "writeProtection" | "teamRole" | "fileHistory" | "permissionMode" | "sessionRules" | "projectMemory";
@@ -66,10 +66,11 @@ type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, W
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
 type WiringSection<K extends keyof WiringManifest> = NonNullable<WiringManifest[K]>;
 type WiringLegHandled = "kind";
-type _GuardWiringLeg = AssertAllKeysHandled<Exclude<keyof WiringSection<"leg">, WiringLegHandled>>;
-type _GuardWiringLegReverse = AssertAllKeysHandled<Exclude<WiringLegHandled, keyof WiringSection<"leg">>>;
+type WiringLegExcluded = "runOrigin";
+type _GuardWiringLeg = AssertAllKeysHandled<Exclude<keyof WiringSection<"leg">, WiringLegHandled | WiringLegExcluded>>;
+type _GuardWiringLegReverse = AssertAllKeysHandled<Exclude<WiringLegHandled | WiringLegExcluded, keyof WiringSection<"leg">>>;
 type WiringModRowKeys = WiringSection<"mods">[number] extends infer R ? (R extends unknown ? keyof R : never) : never;
-type WiringModRowHandled = "name" | "seat" | "tier" | "events" | "observe" | "skipped" | "refusedBy" | "reason";
+type WiringModRowHandled = "name" | "seat" | "tier" | "provenance" | "events" | "observe" | "skipped" | "refusedBy" | "reason";
 type _GuardWiringModRow = AssertAllKeysHandled<Exclude<WiringModRowKeys, WiringModRowHandled>>;
 type _GuardWiringModRowReverse = AssertAllKeysHandled<Exclude<WiringModRowHandled, WiringModRowKeys>>;
 type WiringModSkipKeys = keyof NonNullable<Extract<WiringSection<"mods">[number], {
@@ -108,7 +109,11 @@ type _GuardSubagentTranscriptTierWords = AssertAllKeysHandled<Exclude<SubagentTr
 type _GuardSubagentTranscriptTierWordsReverse = AssertAllKeysHandled<Exclude<SubagentTranscriptTierWords, SubagentTranscriptTier>>;
 type WiringMcpEntry = WiringSection<"mcp">[number];
 type WiringMcpExcluded = "error";
-type WiringMcpHandled = "name" | "source" | "status" | "errorCode" | "delivered" | "httpStatus" | "toolCount" | "liveness" | WiringMcpExcluded;
+type WiringMcpHandled = "name" | "source" | "status" | "errorCode" | "delivered" | "httpStatus" | "toolCount" | "liveness" | "authorization" | WiringMcpExcluded;
+type McpAuthorizationRecord = NonNullable<WiringMcpEntry["authorization"]>;
+type McpAuthorizationTables = typeof import("../mcp-authorization-face.js");
+type _GuardMcpAuthorization = AssertAllKeysHandled<Exclude<keyof McpAuthorizationRecord, TableCoreKeys<McpAuthorizationTables["MCP_AUTHORIZATION_DISPOSITIONS"]>>>;
+type _GuardMcpAuthorizationReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<McpAuthorizationTables["MCP_AUTHORIZATION_DISPOSITIONS"]>, keyof McpAuthorizationRecord>>;
 type _GuardWiringMcp = AssertAllKeysHandled<Exclude<keyof WiringMcpEntry, WiringMcpHandled>>;
 type _GuardWiringMcpReverse = AssertAllKeysHandled<Exclude<WiringMcpHandled, keyof WiringMcpEntry>>;
 type WiringMcpLiveness = NonNullable<WiringMcpEntry["liveness"]>;
@@ -212,27 +217,27 @@ type _GuardPromptManifestKeysNonEmpty = AssertAllKeysHandled<{
     [L in keyof ManifestCore]: [ManifestDeclared<ManifestFaces, L>] extends [never] ? L : never;
 }[keyof ManifestCore]>;
 type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence" | "checkpointId";
-type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "approvalCard" | "restoreMode" | "previewWithheld" | "authoredBy";
+type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "approvalCard" | "restoreMode" | "previewWithheld" | "authoredBy" | "runOrigin" | "requestedByCallId";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
 type ParkArmKeys = keyof Extract<PendingAction, {
     kind: "tool_approval";
 }>;
 type ParkArmQueueProjected = "toolName" | "toolCallId" | "boundInputHash" | "ruleOffers" | "hasBidiControls" | keyof import("../approval-card.js").ParkRowFacts | keyof import("../approval-card.js").SkillCardFacts;
-type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "family" | "pathTarget" | "hostTarget" | "targets" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "engineMounted";
+type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "family" | "pathTarget" | "hostTarget" | "targets" | "targetReads" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "engineMounted" | "declarationDigest";
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptRole" | "promptBinding" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptLean" | "toolPolicy" | "onAsk" | "onQuestion" | "mods" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "projectMemory" | "allowedTools" | "allowTools" | "userAttachments" | "readDenyPatterns" | "writeProtectedAdditions" | "complianceAdditionalDenies";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptRole" | "promptBinding" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptLean" | "toolPolicy" | "onAsk" | "onQuestion" | "mods" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "projectMemory" | "allowedTools" | "allowTools" | "userAttachments" | "readDenyPatterns" | "writeProtectedAdditions" | "complianceAdditionalDenies" | "projectId";
 /** 导出:请求体键闭集门(`request-key-closure.ts`)据它锁「本仓记为未接线的引擎座,提交口不许受理」—— 两处分类只能同向。 */
-export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "modelRole" | "enableBlockedReport" | "promptForm" | "advisorModel";
+export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "modelRole" | "enableBlockedReport" | "promptForm" | "advisorModel" | "runOrigin" | "planFile" | "classifyAllShell";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction" | "resultEntryIds";
 type TaskResultStripped = never;
 type _GuardTaskResult = AssertAllKeysHandled<Exclude<keyof TaskResult, TaskResultForwarded | TaskResultStripped>>;
 type _GuardTaskResultReverse = AssertAllKeysHandled<Exclude<TaskResultForwarded | TaskResultStripped, keyof TaskResult>>;
-type PausedCauseForwarded = "kind" | "gate" | "checkpointId" | "restoreMode";
+type PausedCauseForwarded = "kind" | "gate" | "checkpointId" | "restoreMode" | "requestedByCallId";
 type PausedCauseStripped = "token";
 type _GuardPausedCause = AssertAllKeysHandled<Exclude<keyof PausedCause, PausedCauseForwarded | PausedCauseStripped>>;
 type _GuardPausedCauseReverse = AssertAllKeysHandled<Exclude<PausedCauseForwarded | PausedCauseStripped, keyof PausedCause>>;
@@ -247,7 +252,7 @@ type SessionMemoryStatusProjected = "captureOptedOut" | "committedCount" | "fold
 type SessionMemoryStatusExcluded = "writeHome";
 type _GuardSessionMemoryStatus = AssertAllKeysHandled<Exclude<keyof SessionMemoryStatus, SessionMemoryStatusProjected | SessionMemoryStatusExcluded>>;
 type _GuardSessionMemoryStatusReverse = AssertAllKeysHandled<Exclude<SessionMemoryStatusProjected | SessionMemoryStatusExcluded, keyof SessionMemoryStatus>>;
-type SideQueryResultForwarded = "text" | "toolCalls" | "model" | "servedModel" | "degraded" | "responseModel" | "usage" | "usageMissing" | "stopReason" | "errorMessage" | "errorCode" | "errorKind" | "inputTooLongRuledOut";
+type SideQueryResultForwarded = "text" | "toolCalls" | "model" | "servedModel" | "degraded" | "responseModel" | "usage" | "usageMissing" | "stopReason" | "errorMessage" | "errorCode" | "errorKind" | "inputTooLongRuledOut" | "account";
 type SideQueryResultStripped = never;
 type _GuardSideQueryResult = AssertAllKeysHandled<Exclude<keyof SideQueryResult, SideQueryResultForwarded | SideQueryResultStripped>>;
 type _GuardSideQueryResultReverse = AssertAllKeysHandled<Exclude<SideQueryResultForwarded | SideQueryResultStripped, keyof SideQueryResult>>;
@@ -261,7 +266,7 @@ type GateOutcomeProjected = "disposition" | "settlement" | "origin";
 type _GuardGateOutcome = AssertAllKeysHandled<Exclude<keyof GateOutcome, GateOutcomeProjected>>;
 type _GuardGateOutcomeReverse = AssertAllKeysHandled<Exclude<GateOutcomeProjected, keyof GateOutcome>>;
 type GateDispositionKeys = GateDisposition extends infer D ? (D extends object ? keyof D : never) : never;
-type GateDispositionProjected = "kind" | "deniedBy" | "cause" | "classifier" | "released" | "clearedBy" | "mode" | "askClass" | "classes";
+type GateDispositionProjected = "kind" | "deniedBy" | "cause" | "classifier" | "released" | "clearedBy" | "mode" | "askClass" | "classes" | "extension";
 type _GuardGateDisposition = AssertAllKeysHandled<Exclude<GateDispositionKeys, GateDispositionProjected>>;
 type _GuardGateDispositionReverse = AssertAllKeysHandled<Exclude<GateDispositionProjected, GateDispositionKeys>>;
 type SettlementProjected = "kind" | "who" | "when" | "note";
@@ -301,12 +306,12 @@ type McpReconnectWithheld = "axes" | "dropped" | "warnings";
 type _GuardMcpReconnect = AssertAllKeysHandled<Exclude<keyof McpReconnectResult, McpReconnectProjected | McpReconnectWithheld>>;
 type _NoDoubleBookMcpReconnect = AssertAllKeysHandled<Extract<McpReconnectProjected, McpReconnectWithheld>>;
 type _GuardMcpReconnectReverse = AssertAllKeysHandled<Exclude<McpReconnectProjected | McpReconnectWithheld, keyof McpReconnectResult>>;
-type McpRedialStatusProjected = "name" | "status" | "errorCode" | "httpStatus" | "delivered" | "serverInfo" | "error" | "transportClosed";
+type McpRedialStatusProjected = "name" | "status" | "errorCode" | "httpStatus" | "delivered" | "authorization" | "serverInfo" | "error" | "transportClosed";
 type McpRedialStatusWithheld = "toolNames" | "liveness";
 type _GuardMcpRedialStatus = AssertAllKeysHandled<Exclude<keyof McpServerStatus, McpRedialStatusProjected | McpRedialStatusWithheld>>;
 type _NoDoubleBookMcpRedialStatus = AssertAllKeysHandled<Extract<McpRedialStatusProjected, McpRedialStatusWithheld>>;
 type _GuardMcpRedialStatusReverse = AssertAllKeysHandled<Exclude<McpRedialStatusProjected | McpRedialStatusWithheld, keyof McpServerStatus>>;
-type McpPanelStatusProjected = "name" | "status" | "serverInfo" | "toolNames" | "error";
+type McpPanelStatusProjected = "name" | "status" | "serverInfo" | "toolNames" | "error" | "authorization";
 type McpPanelStatusWithheld = "errorCode" | "httpStatus" | "delivered" | "transportClosed" | "liveness";
 type _GuardMcpPanelStatus = AssertAllKeysHandled<Exclude<keyof McpServerStatus, McpPanelStatusProjected | McpPanelStatusWithheld>>;
 type _NoDoubleBookMcpPanelStatus = AssertAllKeysHandled<Extract<McpPanelStatusProjected, McpPanelStatusWithheld>>;
@@ -323,6 +328,12 @@ type _NoDoubleBookLspOptions = AssertAllKeysHandled<Extract<LspOptionsWired, Lsp
 /** ⑯ 账上记过、已接线的 `RunnerDeps` 席([ref] 起 `fileHistoryCapture`)。反向钉:core 改名 / 退役 ⇒ 红。 */
 type RunnerDepsLedgerWired = "fileHistoryCapture";
 type _GuardLedgerRunnerDepsReverse = AssertAllKeysHandled<Exclude<RunnerDepsLedgerWired, keyof RunnerDeps>>;
+type SessionWorkspaceTables = typeof import("../session-workspace.js");
+type WorkspaceChangedArm = Extract<TaskEvent, {
+    type: "workspace_changed";
+}>;
+type _GuardSessionWorkspace = AssertAllKeysHandled<Exclude<keyof WorkspaceChangedArm, TableCoreKeys<SessionWorkspaceTables["SESSION_WORKSPACE_DISPOSITIONS"]>>>;
+type _GuardSessionWorkspaceReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<SessionWorkspaceTables["SESSION_WORKSPACE_DISPOSITIONS"]>, keyof WorkspaceChangedArm>>;
 export type CoreKeysetGuards = [
     _GuardNotification,
     _GuardTerminalArm,
@@ -384,6 +395,8 @@ export type CoreKeysetGuards = [
     _GuardWiringModSkipReverse,
     _GuardWiringMcp,
     _GuardWiringMcpReverse,
+    _GuardMcpAuthorization,
+    _GuardMcpAuthorizationReverse,
     _GuardWiringRules,
     _GuardWiringRulesReverse,
     _GuardWiringModelGate,
@@ -463,7 +476,9 @@ export type CoreKeysetGuards = [
     _GuardLspOptions,
     _NoDoubleBookLspOptions,
     _GuardLspOptionsReverse,
-    _GuardLedgerRunnerDepsReverse
+    _GuardLedgerRunnerDepsReverse,
+    _GuardSessionWorkspace,
+    _GuardSessionWorkspaceReverse
 ];
 export {};
 //# sourceMappingURL=core-keyset-guard.d.ts.map

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.image_removed", "mcp.authorization_required"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;

package/dist/trace/engine-notice-wire.js

@@ -46,6 +46,8 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "advisor.not_attached",
     "inherit_env.names_withheld",
     "model.capability_downgraded",
+    "context.image_removed",
+    "mcp.authorization_required",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {

package/dist/trace/exit-seat.d.ts

@@ -13,7 +13,14 @@ export type SafeText = string & {
  *  · `operator-log-arg`:运维日志字段里模型写的工具入参(`tool_trace` 的 `arg.*`:路径 / 命令 / 模式 / 非对象入参的串形);界 120 码元(含截断记号);
  *  · `operator-log-error`:运维日志字段里 hook 一侧的报错 —— hook 命令的 stderr、prompt 条目的载体失败句、起子进程 / 读会话分支抛出的句子;界 300 码元(含截断记号);
  *  · `operator-log-message`:运维日志字段里写给人看的一段话 —— hook 输出的 `systemMessage`、Stop 评估者判「做不到」的理由;界 500 码元(含截断记号);
- *  · `session-title`:自动标题器落行的会话标题(落库 / 列表面 / `session_titled` 帧同一份);界 80 码元(含截断记号),在 `title` 列宽之内。
+ *  · `session-title`:自动标题器落行的会话标题(落库 / 列表面 / `session_titled` 帧同一份);界 80 码元(含截断记号),在 `title` 列宽之内;
+ *  · `mcp-remote-text`:MCP 远端失败句(远端可控自由文本,租户面)—— `GET /v1/sessions/:id/mcp` 面板的 `servers[].error` 与 `POST /v1/sessions/:id/mcp/reconnect`
+ *    的 `reason` / `status.error` / `listingIncomplete.error`;引擎铸点已抹过请求回显与同主体词表(记号 `[redacted]`),这一行读同一个脱敏器(引擎记号 = 已抹的值,
+ *    引擎放过的形照抹);界 200 码元,原样出门(JSON 串值,消费方自己渲染)。
+ *  · `peer-declaration-sentence`:引擎判官对一份 MCP / A2A 对端声明说的句子(`toolAxes` / `toolFaces` / `sessionMetaKey` / 启动界的原因句,逐字带着声明方写的工具名、键名),
+ *    进请求面 400 拒句、续跑重放的丢弃行与重读行、名册的跳过行 —— 读者是调用方与运维,句子已是一行;不设界(拒句要说全判官的话),原样出门。
+ *  · `boot-refusal-line`:起服拒启的一行拒句 —— 部署座装配的拒句(`mods-declaration.ts`:声明的席名、包名、读包者 / 引擎准入交回的话);它经进程级 fatal 出口原样多行进 stderr,
+ *    所以必须在这里先压成一行(一句拒因里的换行会在运维的终端里伪造出第二条日志行);界 512 码元(含截断记号)。
  */
 declare const EXIT_SEATS: {
     readonly "trace-frame-text": {
@@ -48,6 +55,18 @@ declare const EXIT_SEATS: {
         readonly maxChars: 80;
         readonly emit: "title-line";
     };
+    readonly "mcp-remote-text": {
+        readonly scope: "free-text";
+        readonly maxChars: 200;
+    };
+    readonly "peer-declaration-sentence": {
+        readonly scope: "free-text";
+    };
+    readonly "boot-refusal-line": {
+        readonly scope: "free-text";
+        readonly maxChars: 512;
+        readonly emit: "log-line";
+    };
 };
 export type ExitSeat = keyof typeof EXIT_SEATS;
 /** 设了界的座名。 */

package/dist/trace/exit-seat.js

@@ -12,6 +12,9 @@ const EXIT_SEATS = {
     "operator-log-error": { scope: "free-text", maxChars: 300, emit: "log-line" },
     "operator-log-message": { scope: "free-text", maxChars: 500, emit: "log-line" },
     "session-title": { scope: "free-text", maxChars: 80, emit: "title-line" },
+    "mcp-remote-text": { scope: "free-text", maxChars: 200 },
+    "peer-declaration-sentence": { scope: "free-text" },
+    "boot-refusal-line": { scope: "free-text", maxChars: 512, emit: "log-line" },
 };
 export function seatMaxChars(seat) {
     return EXIT_SEATS[seat].maxChars;

package/dist/trace/extension-call-face.d.ts

@@ -0,0 +1,33 @@
+/**
+ * 扩展自己发起 / 代答 / 改写的工具调用在 wire 上的三位 —— `requestedBy`(谁要的这只调用)、`answeredBy`(哪张注册在 `tool.call` 上代替工具体作答)与
+ * `tool_end.rewrite`(门放行时交给工具体的参数不是它收进来的那份:放行的那份 + 谁改的)的**唯一读法**。
+ *
+ * 引擎的事实(core `ExtensionRequester` / `tool_end.answeredBy`):一张注册经 `$.tool.call` 发起的调用,`tool_start` / `tool_end` 与审批卡都带
+ * `requestedBy: { kind: "extension", name }`(模型消息带来的调用上缺席);注册在 `tool.call` 站上以自己的结果或拒答代替工具体时,`tool_end` 带
+ * `answeredBy: <注册名>`(旁边恒有 `notExecuted: true`)。本仓的部署座装上运维声明的包之后,这两位真能到达 —— 投影它们。
+ *
+ * 读法(写腿与读腿、帧与卡同一只):
+ *  · 注册名是**注册方定的串** ⇒ 过 {@link sanitizeWireText}(与 `wiring_manifest.mods[]` 的 `name`、通告 `mods.registration_refused` 同一只出口纪律),
+ *    同一张注册在三处的名逐字节相等;
+ *  · 形不对(`kind` 不是 `"extension"`、`name` 不是非空串、`answeredBy` 不是非空串)⇒ 丢这一位、计一次 `server.trace.projection-input-malformed`
+ *    (纯归因位:半张归因比没有更坏,不修补);缺席 = 没有这件事(正面事实),不计;
+ *  · `rewrite`(引擎 7.58.0 `ToolInputRewrite`)整只一位:`by` 每项是改写者(扩展项的注册名同上过出口纪律;`policy` / `approver` 两项无成员),`input` 是工具参数
+ *    (模型 / 扩展 / 审批人写的)⇒ 经调用方交进来的工具参数投影 —— 与 `tool_start.args` 同一只(`trace/project.ts` 的那一只;本文件不自己答脱敏);
+ *    `by` 不是非空数组、有一项不在三形里、缺 `input` ⇒ 整只丢 + 计一次。
+ *    续跑腿的帧引擎不带它(引擎的未覆盖面),本读法不补。
+ */
+import type { ExtensionRequester, RewriteAuthor } from "@sema-agent/core";
+/** wire 上的发起者位 = 引擎的 `ExtensionRequester` 同形(`name` 已过出口纪律);引擎加一类发起者 ⇒ 这里的形随之,读法下面一处判。 */
+export type ExtensionRequesterFace = Readonly<ExtensionRequester>;
+/** `requestedBy` 的投影(缺席 ⇒ 缺席;形不对 ⇒ 丢 + 计一次)。`where` 进留痕句(哪一面:`tool_start` / `tool_end` / `tool_approval` / 读腿)。 */
+export declare function extensionRequesterOf(v: unknown, where: string): ExtensionRequesterFace | undefined;
+/** `answeredBy` 的投影(缺席 ⇒ 缺席;形不对 ⇒ 丢 + 计一次)。 */
+export declare function extensionAnswererOf(v: unknown, where: string): string | undefined;
+/** wire 上的改写记录 = 引擎的 `ToolInputRewrite` 同形(扩展项的 `name` 已过出口纪律、`input` 已脱敏)。 */
+export interface ToolInputRewriteFace {
+    readonly by: readonly Readonly<RewriteAuthor>[];
+    readonly input: unknown;
+}
+/** `tool_end.rewrite` 的投影(缺席 ⇒ 缺席;形不对 ⇒ 整只丢 + 计一次)。`argsOnWire` = 工具参数上 wire 的那一只投影(与 `tool_start.args` 同一只,调用方交进来)。 */
+export declare function toolInputRewriteOf(v: unknown, where: string, argsOnWire: (args: unknown) => unknown): ToolInputRewriteFace | undefined;
+//# sourceMappingURL=extension-call-face.d.ts.map

package/dist/trace/extension-call-face.js

@@ -0,0 +1,39 @@
+import { sanitizeWireText } from "./engine-notice-wire.js";
+import { dropProjectedFace } from "./projection-drop.js";
+export function extensionRequesterOf(v, where) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v === "object" && v !== null && "kind" in v && "name" in v && v.kind === "extension" && typeof v.name === "string" && v.name !== "")
+        return { kind: "extension", name: sanitizeWireText(v.name) };
+    return dropProjectedFace("extension_call.requestedBy is not { kind: extension, name: <non-empty string> } on " + where);
+}
+export function extensionAnswererOf(v, where) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v === "string" && v !== "")
+        return sanitizeWireText(v);
+    return dropProjectedFace("extension_call.answeredBy is not a non-empty string on " + where);
+}
+const REWRITE_AUTHOR_READERS = {
+    extension: (v) => ("name" in v && typeof v.name === "string" && v.name !== "" ? { kind: "extension", name: sanitizeWireText(v.name) } : undefined),
+    policy: () => ({ kind: "policy" }),
+    approver: () => ({ kind: "approver" }),
+};
+const isRewriteAuthorKind = (kind) => typeof kind === "string" && Object.hasOwn(REWRITE_AUTHOR_READERS, kind);
+function rewriteAuthorOf(v) {
+    if (typeof v !== "object" || v === null || !("kind" in v))
+        return undefined;
+    const kind = v.kind;
+    return isRewriteAuthorKind(kind) ? REWRITE_AUTHOR_READERS[kind](v) : undefined;
+}
+export function toolInputRewriteOf(v, where, argsOnWire) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v === "object" && v !== null && "by" in v && "input" in v && Array.isArray(v.by) && v.by.length > 0) {
+        const by = Array.from(v.by, rewriteAuthorOf);
+        if (by.every((a) => a !== undefined))
+            return { by, input: argsOnWire(v.input) };
+    }
+    return dropProjectedFace("tool_end.rewrite is not { by: <non-empty list of extension / policy / approver>, input } on " + where);
+}
+//# sourceMappingURL=extension-call-face.js.map