@sema-agent/server 7.141.0 → 7.143.0

package/dist/hooks/hook-runner.js

@@ -4,6 +4,7 @@ import vm from "node:vm";
 import { hostShell, resolveHostShell, adoptHostForegroundChild, killTreeSoft, killTreeHard } from "../plugins/host-platform.js";
 import { classifyHooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_ENTRY_TYPES, HOOK_EVENTS, HOOK_EVENT_OWNER, HOOK_EVENT_MATCHER_FIELD, hookMatcherForm, hookMatcherSelects, interpolateHookEnvVars, } from "@sema-agent/settings-schema/hooks";
 import { findUrlCredential, formatConfigPath, outgoingPath } from "@sema-agent/settings-schema";
+import { httpHookEnvVarsAllowed, httpHookUrlVerdict } from "@sema-agent/settings-schema";
 import { ENGINE_OWNED_HOOK_EVENTS } from "@sema-agent/settings-schema/hooks";
 import { describeToolCatalog } from "@sema-agent/core";
 import { hangClassic } from "./classic-stations.js";
@@ -511,6 +512,7 @@ export function hookIfMatches(cond, payload) {
         return "unevaluable";
     }
 }
+const SERVER_WORKSPACE_TRUST = "no_trust_step";
 const MAX_LLM_ENTRIES_PER_EVENT = 4;
 const DEFAULT_PROMPT_HOOK_TIMEOUT_SECONDS = 30;
 const DEFAULT_AGENT_HOOK_TIMEOUT_SECONDS = 120;
@@ -670,19 +672,37 @@ function noteVerdictUntrusted(ctx, args) {
         return;
     emitHookNotice(ctx, notice);
 }
+const VERDICT_GAP_CAUSE = {
+    matcher_invalid: "verdict_unfinished",
+    llm_carrier_unavailable: "verdict_unfinished",
+    llm_cap: "verdict_unfinished",
+    powershell_unsupported: "verdict_unfinished",
+    if_unevaluable: "verdict_unfinished",
+    budget_exhausted: "verdict_unfinished",
+    spawn_failed: "verdict_unfinished",
+    timeout: "verdict_unfinished",
+    exit_nonzero: "verdict_unfinished",
+    bad_json: "verdict_unreadable",
+    decision_out_of_set: "verdict_unreadable",
+    evidence_unavailable: "verdict_unfinished",
+    rewrite_unsettled: "verdict_unfinished",
+    url_not_allowed: "verdict_unfinished",
+    input_truncated: "verdict_unreadable",
+    matcher_over_budget: "verdict_unreadable",
+};
 function createUnrunLedger(ctx, event, toolName) {
-    let managedWithoutVerdict = false;
+    let managedVerdictGap;
     return {
         untrusted(source, entry, reason) {
             if (hookPhaseOf(source) === "unmanaged")
                 return;
-            managedWithoutVerdict = true;
+            managedVerdictGap ??= VERDICT_GAP_CAUSE[reason];
             noteVerdictUntrusted(ctx, { event, reason, entry, source, toolName });
         },
         unrun(source, entry, reason, detail) {
             if (source === undefined || hookPhaseOf(source) === "unmanaged")
                 return;
-            managedWithoutVerdict = true;
+            managedVerdictGap ??= VERDICT_GAP_CAUSE[reason];
             ctx.logger.warn("hook_managed_unrun", { event, reason, source: echoCallerText(source), type: entry.type, ...(toolName !== undefined ? { tool: toolName } : {}) });
             if (!ctx.onHookNotice)
                 return;
@@ -697,8 +717,8 @@ function createUnrunLedger(ctx, event, toolName) {
                 ...(detail !== undefined ? { detail: boundedNoticeText(detail) } : {}),
             });
         },
-        get managedWithoutVerdict() {
-            return managedWithoutVerdict;
+        get managedVerdictGap() {
+            return managedVerdictGap;
         },
     };
 }
@@ -996,8 +1016,29 @@ async function runLlmHook(entry, payload, ctx, extra) {
             clearTimeout(hardTopTimer);
     }
 }
+function httpHookWithheldSentence(event, block) {
+    const field = `settings.${block.list}`;
+    const [why, exit] = (() => {
+        switch (block.rule) {
+            case "url":
+                return [`its url matches no pattern in ${field}`, `add a pattern that matches the url to ${field}, or point the hook at a url the list allows`];
+            case "empty":
+                return [`${field} is an empty list, so no http hook may run`, `add a pattern that matches the url to ${field}`];
+            case "malformed":
+                return [`${field} is not an array of strings, so it is read as allowing no url`, `write ${field} as an array of url pattern strings`];
+            default: {
+                const unhandled = block.rule;
+                throw new Error(`httpHookWithheldSentence: unhandled rule ${String(unhandled)}`);
+            }
+        }
+    })();
+    return `settings.hooks.${event}: http hook not sent — ${why} (rule: ${block.rule}); ${exit}`;
+}
 const MAX_BLANKED_REFERENCES_LOGGED = 16;
 async function runHttpHook(entry, payload, ctx, event) {
+    const block = httpHookUrlVerdict(entry.url, ctx.httpHookAllowlistLayers, SERVER_WORKSPACE_TRUST);
+    if (block !== undefined)
+        return { code: null, stdout: "", stderr: "", timedOut: false, withheld: block };
     const timeoutMs = Math.min(entry.timeout ?? DEFAULT_HOOK_TIMEOUT_SECONDS, MAX_HOOK_TIMEOUT_SECONDS) * 1000;
     let hookChildVars;
     try {
@@ -1006,7 +1047,7 @@ async function runHttpHook(entry, payload, ctx, event) {
     catch (e) {
         return { code: null, stdout: "", stderr: "", timedOut: false, spawnError: String(e) };
     }
-    const interpolated = interpolateHookEnvVars(entry.headers ?? {}, entry.allowedEnvVars ?? [], hookChildVars);
+    const interpolated = interpolateHookEnvVars(entry.headers ?? {}, httpHookEnvVarsAllowed(entry.allowedEnvVars ?? [], ctx.httpHookAllowlistLayers, SERVER_WORKSPACE_TRUST), hookChildVars);
     if (interpolated.blanked.length > 0) {
         ctx.logger.warn("hook_http_header_env_blanked", {
             event,
@@ -1210,6 +1251,12 @@ async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceF
                 ctx.logger.warn("hook_command_killed", { event, type: entry.type, killed: true, signal: run.aborted.signal });
             return { kind: "halted" };
         }
+        if (run.withheld !== undefined) {
+            const { list, rule, sources } = run.withheld;
+            ctx.logger.warn("hook_http_withheld", { event, url: entry.type === "http" ? buildDisplaySafeUrl(entry.url) : null, list, rule, sources: [...sources] });
+            noteHookFailure(ctx, { event, entry, reason: "url_not_allowed", detail: httpHookWithheldSentence(event, run.withheld), ...(toolName !== undefined ? { toolName } : {}) });
+            return { kind: "unrun", reason: "url_not_allowed" };
+        }
         if (run.spawnError) {
             ctx.logger.warn(entry.type === "http" ? "hook_http_request_failed" : entry.type === "prompt" || entry.type === "agent" ? "hook_llm_failed" : "hook_command_spawn_failed", { event, type: entry.type, error: seatText("operator-log-error", run.spawnError) });
             if (!run.noticed)
@@ -1465,12 +1512,14 @@ export function createSettingsHooksRegistration(config, ctx, budgetMs) {
                 }
             }
             if (asked !== undefined) {
-                return { action: "ask", message: asked, ...(rewritten ? { updatedInput: currentInput } : {}), ...contextField() };
+                return { action: "ask", message: asked, questionCause: "asked", ...(rewritten ? { updatedInput: currentInput } : {}), ...contextField() };
             }
-            if (ledger.managedWithoutVerdict) {
+            const managedGap = ledger.managedVerdictGap;
+            if (managedGap !== undefined) {
                 return {
                     action: "ask",
                     message: "a managed PreToolUse hook did not run to a verdict — approval required",
+                    questionCause: managedGap,
                     ...(rewritten ? { updatedInput: currentInput } : {}),
                     ...contextField(),
                 };
@@ -1479,6 +1528,7 @@ export function createSettingsHooksRegistration(config, ctx, budgetMs) {
                 return {
                     action: "ask",
                     message: "a PreToolUse hook returned an unrecognized permissionDecision — approval required",
+                    questionCause: "verdict_unreadable",
                     ...(rewritten ? { updatedInput: currentInput } : {}),
                     ...contextField(),
                 };

package/dist/host-decision.d.ts

@@ -15,7 +15,7 @@
  * ⇒ 本仓的规则从「记住一张词×决定的相容表」变成「说出你知道的那两件事」。相容性也不再靠记忆:一次
  * sweep 不可能 `allow`,core pre-CAS 拒。
  */
-import { type AskOutcome, type HostDecider, type PermissionResult, type ResumeOutcome } from "@sema-agent/core";
+import { type AskOutcome, type DecidedVia, type HostDecider, type PermissionResult, type ResumeOutcome } from "@sema-agent/core";
 /**
  * 谁结束了这次等待,以及通道自报的归属。
  *  · `decidedBy: "person"` —— 一个人经审批通道做的决定(决定体缺席 `decidedBy` 即此);
@@ -32,7 +32,7 @@ import { type AskOutcome, type HostDecider, type PermissionResult, type ResumeOu
  *  · **铸**(本仓自己观察到的事实):只有 `"timeout"` —— 同步 `onAsk` 腿的等待窗归**宿主**所有(引擎不为
  *    一个它没排程的回调起表),所以「本仓的 TTL 窗走完了、没人答」这件事引擎结构上观察不到,不自报就
  *    永远被记成「一个人拒绝了」;
- *  · **转**(调用方在决定体里陈述的事实):决定体的 `decidedBy:"policy"` 经 {@link liveSettledBy} 落成这一格的
+ *  · **转**(调用方在决定体里陈述的事实):决定体的 `decidedBy:"policy"` 经 {@link liveHostSource} 落成这一格的
  *    `"policy"` = 答这张卡的是**这台部署自己的策略**,不是人。wire 上的词只有 {@link APPROVAL_DECIDED_BY} 两个,
  *    映射只有那一只函数 —— 这一格的「转」不再是一个原样过境的串。
  * 逐词(词表属主恒是 core):
@@ -53,6 +53,15 @@ import { type AskOutcome, type HostDecider, type PermissionResult, type ResumeOu
 export type HostSettledBy = NonNullable<Extract<AskOutcome, {
     allow: boolean;
 }>["settledBy"]>;
+/**
+ * **同步座的宿主自报**,一只值 —— `AskOutcome` 对象臂上 `settledBy` 与 `decidedVia`(core 7.61.0 [ref])这两格,交引擎时**原样摊开**
+ * (`{ allow, ...source }`),所以结算腿、判决、行读回都传这一只、不各传两格。`decidedVia` 只在 `settledBy: "policy"` 旁
+ * (core 的同一条律;本仓两个产地都守它:决定体经 {@link liveHostSource},问账行经店门 `assertDecideSource`);本仓自己的窗只说 `{ settledBy: "timeout" }`。
+ */
+export type HostSource = {
+    readonly settledBy: HostSettledBy;
+    readonly decidedVia?: DecidedVia;
+};
 /** 直接取 core `ResumeOutcome` policy_ask 臂的 `hostDecision` 型 —— 本仓不复述那几个词(第二铸点)。它的 `decidedBy` 就是 core 的 `HostDecider`
  *  (core 7.45.0 [ref]:三个型位读同一只闭集)。**谁结束了这次等待**的闭集只有 core 包根那一只(`HOST_DECIDERS` / `HostDecider` / `isHostDecider`)。 */
 export type HostDecision = Extract<ResumeOutcome, {
@@ -62,9 +71,9 @@ export type HostDecision = Extract<ResumeOutcome, {
  * ══ 决定体的出处位 `decidedBy`:一只闭集、一只读法、一只映射 ═══════════════════════════════════════════════
  *
  * 规则一句话:**一个审批决定用一只键说是谁做的** —— `decidedBy ∈ {"person","policy"}`,缺席 = `"person"`;读它的只有
- * {@link readDecidedBy}(三条工具审批决定口共读:live `POST /v1/tool-approvals/:id/respond`、耐久 ask 账
+ * {@link readDecider}(三条工具审批决定口共读:live `POST /v1/tool-approvals/:id/respond`、耐久 ask 账
  * `POST /v1/tasks/:id/asks/:askId/decision`、耐久 `POST /v1/approvals/:sessionId/decide`),把它交给引擎的只有
- * {@link liveSettledBy}(同步座 `AskOutcome.settledBy`)与 {@link hostDecisionFacts}(停驻座 `hostDecision.decidedBy`)。
+ * {@link liveHostSource}(同步座 `AskOutcome.settledBy`)与 {@link hostDecisionFacts}(停驻座 `hostDecision.decidedBy`)。
  *  · 词与决定动词**正交**:策略可以放行也可以拒(core 7.39.0 起引擎铸 `policy_allowed` / `policy_refused`)。唯一的例外是
  *    引擎自己的那一条 —— 一张要人的卡(`requiresRealApproval`)不归策略答,见 {@link heldAskOf}(判官是 core 的 `policyCannotAnswer`)。
  *  · `"sla_timeout"` **永不从 wire 收**:那是「等待到点、没人答」,只有本服务自己的截止扫说得出来(`approval-sweeps.ts`
@@ -80,10 +89,15 @@ declare const SWEEP_ONLY_DECIDER = "sla_timeout";
 /** wire 上的出处词(决定体 `decidedBy` 的值域)= core 闭集去掉扫的那一个。 */
 export type ApprovalDecidedBy = Exclude<HostDecider, typeof SWEEP_ONLY_DECIDER>;
 /** wire 闭集的运行期值:core `HOST_DECIDERS`([ref])去掉扫的那一个,顺序随 core。core 加一个词 ⇒ 它在这里自动在场(决定口的门照收;两只座的映射
- *  {@link liveSettledBy} 的穷举 `switch` 编译红,由人裁它在同步座上怎么落)。 */
+ *  {@link liveHostSource} 的穷举 `switch` 编译红,由人裁它在同步座上怎么落)。 */
 export declare const APPROVAL_DECIDED_BY: readonly ApprovalDecidedBy[];
-/** 闭集外的拒句(三条决定口同一句;码按各口既有约定,见 {@link readDecidedBy})。成员表派生自 {@link APPROVAL_DECIDED_BY}(词表一个来源;今天字节与 7.118.0 同)。 */
+/** 闭集外的拒句(四条决定口同一句;码按各口既有约定,见 {@link readDecider})。成员表派生自 {@link APPROVAL_DECIDED_BY}(词表一个来源;今天字节与 7.118.0 同)。 */
 export declare const DECIDED_BY_OUTSIDE_CLOSED_SET: string;
+/**
+ * 机器座位 `decidedVia` 的拒句(四条决定口同一句,与 {@link DECIDED_BY_OUTSIDE_CLOSED_SET} 同码同位)。成员表派生自 core `DECIDED_VIA`。
+ * 一句覆盖两种拒:词表外(含 `null` / 空串 / 非串 —— 在场即陈述,与 `decidedBy` 同一条在场口径),与**旁边不是策略**(`decidedBy` 缺席 = 一个人,人的决定没有机器座位)。
+ */
+export declare const DECIDED_VIA_OUTSIDE_SEAT: string;
 /** 直连门上的拒句(与 `remember` / `updatedInput` / `checkpointToken` 同族:键不在决策证明的签名载荷里)。 */
 export declare const DECIDED_BY_NOT_IN_PROOF = "decidedBy is not supported on a direct-door worker (not covered by the decision proof)";
 /** 一张要人的卡上策略的放行(两条决定口同一句;判官 core `policyCannotAnswer`,问形见 {@link heldAskOf})。 */
@@ -115,31 +129,51 @@ export interface RetiredDecisionKeyFacts {
     };
 }
 export declare function retiredDecisionKeyFacts(body: unknown): RetiredDecisionKeyFacts | undefined;
-/** {@link readDecidedBy} 的判决(调用点做穷举 `switch` + `never` 兜底,各按自己的码约定发出)。 */
-export type DecidedByReading = {
+/**
+ * 决定体陈述的**决定者**:谁做的(`decidedBy`),以及 —— 只当答话的是这台部署的策略时 —— 哪一个机器座位答的(`decidedVia`,core 7.61.0 [ref]:
+ * `"policy"` = 部署自己的策略,`"permission_request_hook"` = 一只 PermissionRequest 钩子替部署答的;缺席与 `"policy"` 同读)。
+ * 只有 {@link readDecider} 铸它;两只座各一只映射({@link liveHostSource} / {@link hostDecisionFacts})。
+ */
+export interface ApprovalDecider {
+    readonly decidedBy: ApprovalDecidedBy;
+    readonly decidedVia?: DecidedVia;
+}
+/** {@link readDecider} 的判决(调用点做穷举 `switch` + `never` 兜底,各按自己的码约定发出;`outside_closed_set` 自带拒句 —— 哪一格越界由读法说,口不猜)。 */
+export type DeciderReading = {
     kind: "accepted";
-    decidedBy: ApprovalDecidedBy;
+    decider: ApprovalDecider;
 } | {
     kind: "not_in_proof";
 } | {
     kind: "outside_closed_set";
+    message: string;
 };
 /**
- * 决定体 `decidedBy` 的**唯一读法**。次序即契约:
- *  ① 缺席 ⇒ `"person"`(缺席律:一条不说话的决定就是一个人按的 —— 与修前逐字同形);
- *  ② 直连门在场且键在场 ⇒ `not_in_proof`(不论值:它不在签名载荷里,能改线上字节的一方可以把人翻成策略;
+ * 决定体决定者两格(`decidedBy` + `decidedVia`)的**唯一读法**。次序即契约:
+ *  ① `decidedBy` 缺席 ⇒ `"person"`(缺席律:一条不说话的决定就是一个人按的 —— 与修前逐字同形);
+ *  ② 直连门在场且 `decidedBy` 在场 ⇒ `not_in_proof`(不论值:它不在签名载荷里,能改线上字节的一方可以把人翻成策略;
  *     第二参给字面 `false` 的调用点 = 那条口没有决策证明,live `/respond` 即此);
- *  ③ 闭集内 ⇒ 那个词;其余一切(`"sla_timeout"`、结算词、别的串、非串、`null`)⇒ `outside_closed_set`。
+ *  ③ `decidedBy` 闭集外(`"sla_timeout"`、结算词、别的串、非串、`null`)⇒ `outside_closed_set`({@link DECIDED_BY_OUTSIDE_CLOSED_SET});
+ *  ④ `decidedVia` 在场(`undefined` 之外一律算在场,`null` 也是 —— 与 `decidedBy` 同一条在场口径)而它不在 core `DECIDED_VIA` 里,或旁边的决定者
+ *     没有座位(人;含 ① 落成的缺席 person ⇒ 直连门上只带 `decidedVia` 也走这一臂,直连门从不受理它)⇒ `outside_closed_set`({@link DECIDED_VIA_OUTSIDE_SEAT});
+ *  ⑤ 受理:`{ decidedBy, decidedVia? }`(座位缺席 ⇒ 读数里没有这一格)。
+ * 问账行上 `decided_via` 列的 NULL 不经本读法:那是店的读口,NULL ⇒ 缺席(旧行与不带座位的决定同读 = 部署自己的策略)。
  */
-export declare function readDecidedBy(raw: unknown, directDoorActive: false): Exclude<DecidedByReading, {
+export declare function readDecider(body: {
+    readonly decidedBy?: unknown;
+    readonly decidedVia?: unknown;
+}, directDoorActive: false): Exclude<DeciderReading, {
     kind: "not_in_proof";
 }>;
-export declare function readDecidedBy(raw: unknown, directDoorActive: boolean): DecidedByReading;
+export declare function readDecider(body: {
+    readonly decidedBy?: unknown;
+    readonly decidedVia?: unknown;
+}, directDoorActive: boolean): DeciderReading;
 /**
- * **同步座的映射**(`AskOutcome.settledBy`;ask 账行的 `settled_by` 列存的也是这一格):`person` ⇒ 不铸键(引擎缺席即按人读,
- * 与修前逐字同形 —— 人的放行仍是裸 `true`),`policy` ⇒ `"policy"`。总函数,无 cast。
+ * **同步座的映射**(`AskOutcome` 的 `settledBy` / `decidedVia`;问账行的 `settled_by` / `decided_via` 两列存的也是这一只值):`person` ⇒ 不自报
+ * (引擎缺席即按人读,与修前逐字同形 —— 人的放行仍是裸 `true`),`policy` ⇒ `{ settledBy: "policy", decidedVia? }`。总函数,无 cast。
  */
-export declare function liveSettledBy(decidedBy: ApprovalDecidedBy): Extract<HostSettledBy, "policy"> | undefined;
+export declare function liveHostSource(decider: ApprovalDecider): HostSource | undefined;
 /**
  * 引擎自己的那一条例外:**一张要人的卡不归策略答** —— 判官是 core 的 `policyCannotAnswer(question, decidedBy)`([ref] 包根导出;引擎的续跑入口、
  * 执行带与同步座读同一条)。本仓**只在自己的副作用先于引擎落地的两条口**上于裁决之前问它(live `/respond`:会话放行 / 常驻规则 / 一条按 approve
@@ -155,7 +189,7 @@ export declare function heldAskOf(demandsAPerson: boolean): Extract<PermissionRe
 /**
  * 一次 decide 的**停驻座事实**,一处成形(耐久 `/decide` 与活卡 PARKED 赎回席共用;截止扫直接铸 `{decidedBy:"sla_timeout"}`)。
  *
- * `decidedBy` = 已经过 {@link readDecidedBy} 的 wire 词:两个词在停驻座上**就是它自己**(`person` / `policy`,
+ * `decidedBy` = 已经过 {@link readDecider} 的 wire 词:两个词在停驻座上**就是它自己**(`person` / `policy`,
  * 两只词表的交集由上面的编译期门证),所以这里没有 cast,也没有缺席律(缺席已在读法里落成 `"person"`)。
  *
  * `principal` = 那条腿已经验过身份的决策者(缺席 = 匿名档的部署,通道确实没有名字可报)。
@@ -167,6 +201,6 @@ export declare function heldAskOf(demandsAPerson: boolean): Extract<PermissionRe
  * 🔴 归属**不按词分岔**:无论 core 的记录怎么写,**本服务观察到的事实**不变:送出这次请求的那把已验证身份是真的,本仓的
  * 迟到结算账本(`approval-ask-audit-store.ts`)记的就是它。按词删一格 = 给账本挖一个只在某个词上出现的洞。
  */
-export declare function hostDecisionFacts(decidedBy: ApprovalDecidedBy, principal: string | undefined): HostDecision;
+export declare function hostDecisionFacts(decider: ApprovalDecider, principal: string | undefined): HostDecision;
 export {};
 //# sourceMappingURL=host-decision.d.ts.map

package/dist/host-decision.js

@@ -1,10 +1,11 @@
-import { HOST_DECIDERS, isHostDecider, screenApproverAttribution } from "@sema-agent/core";
+import { DECIDED_VIA, HOST_DECIDERS, isHostDecider, screenApproverAttribution } from "@sema-agent/core";
 const SWEEP_ONLY_DECIDER = "sla_timeout";
 function isApprovalDecidedBy(v) {
     return isHostDecider(v) && v !== SWEEP_ONLY_DECIDER;
 }
 export const APPROVAL_DECIDED_BY = Object.freeze(HOST_DECIDERS.filter(isApprovalDecidedBy));
 export const DECIDED_BY_OUTSIDE_CLOSED_SET = `decidedBy must be ${APPROVAL_DECIDED_BY.map((w) => `"${w}"`).join(" or ")} when present — who made this decision: a person, or this deployment's own policy (absent = "person"); "${SWEEP_ONLY_DECIDER}" is never accepted from a caller (only this server's own deadline sweep says a wait ended with nobody answering)`;
+export const DECIDED_VIA_OUTSIDE_SEAT = `decidedVia must be ${DECIDED_VIA.map((w) => `"${w}"`).join(" or ")} when present, and only beside decidedBy "policy" — it names which machine seat answered for this deployment's policy (absent = the deployment's own policy); a person's decision has no seat`;
 export const DECIDED_BY_NOT_IN_PROOF = "decidedBy is not supported on a direct-door worker (not covered by the decision proof)";
 export const POLICY_CANNOT_ALLOW_PERSON_ASK = 'decidedBy "policy" cannot allow this ask — it demands a person\'s approval (risk.requiresRealApproval), and a policy\'s answer is not a person\'s; answer it as a person, or refuse it as the policy';
 export const SETTLED_BY_RETIRED = 'settledBy is retired — send decidedBy: "person" | "policy" (who made this decision; absent = "person"); ignoring it would record a policy\'s answer as a person\'s';
@@ -14,30 +15,57 @@ export function retiredDecisionKeyFacts(body) {
         return undefined;
     return body[RETIRED_DECISION_KEY] !== undefined ? { error: SETTLED_BY_RETIRED, extra: { field: RETIRED_DECISION_KEY } } : undefined;
 }
-export function readDecidedBy(raw, directDoorActive) {
-    if (raw === undefined)
-        return { kind: "accepted", decidedBy: "person" };
-    if (directDoorActive)
-        return { kind: "not_in_proof" };
-    return isApprovalDecidedBy(raw) ? { kind: "accepted", decidedBy: raw } : { kind: "outside_closed_set" };
-}
-export function liveSettledBy(decidedBy) {
+function deciderHasSeat(decidedBy) {
     switch (decidedBy) {
         case "person":
-            return undefined;
+            return false;
         case "policy":
-            return "policy";
+            return true;
         default: {
             const unreachable = decidedBy;
-            throw new Error(`liveSettledBy: unknown decidedBy ${String(unreachable)}`);
+            throw new Error(`deciderHasSeat: unknown decidedBy ${String(unreachable)}`);
+        }
+    }
+}
+export function readDecider(body, directDoorActive) {
+    let decidedBy = "person";
+    const rawBy = body.decidedBy;
+    if (rawBy !== undefined) {
+        if (directDoorActive)
+            return { kind: "not_in_proof" };
+        if (!isApprovalDecidedBy(rawBy))
+            return { kind: "outside_closed_set", message: DECIDED_BY_OUTSIDE_CLOSED_SET };
+        decidedBy = rawBy;
+    }
+    const rawVia = body.decidedVia;
+    if (rawVia === undefined)
+        return { kind: "accepted", decider: { decidedBy } };
+    const via = DECIDED_VIA.find((w) => w === rawVia);
+    if (via === undefined || !deciderHasSeat(decidedBy))
+        return { kind: "outside_closed_set", message: DECIDED_VIA_OUTSIDE_SEAT };
+    return { kind: "accepted", decider: { decidedBy, decidedVia: via } };
+}
+export function liveHostSource(decider) {
+    switch (decider.decidedBy) {
+        case "person":
+            return undefined;
+        case "policy":
+            return { settledBy: "policy", ...(decider.decidedVia !== undefined ? { decidedVia: decider.decidedVia } : {}) };
+        default: {
+            const unreachable = decider.decidedBy;
+            throw new Error(`liveHostSource: unknown decidedBy ${String(unreachable)}`);
         }
     }
 }
 export function heldAskOf(demandsAPerson) {
     return demandsAPerson ? { action: "ask", requiresRealApproval: true } : { action: "ask" };
 }
-export function hostDecisionFacts(decidedBy, principal) {
+export function hostDecisionFacts(decider, principal) {
     const screened = screenApproverAttribution(principal);
-    return { decidedBy, ...(screened.approver !== undefined ? { approver: screened.approver } : {}) };
+    return {
+        decidedBy: decider.decidedBy,
+        ...(screened.approver !== undefined ? { approver: screened.approver } : {}),
+        ...(decider.decidedVia !== undefined ? { decidedVia: decider.decidedVia } : {}),
+    };
 }
 //# sourceMappingURL=host-decision.js.map

package/dist/http/admission.d.ts

@@ -68,7 +68,7 @@ export declare function createAdmission(ctx: {
     deps: FlatServiceDeps;
     runnerFor: FlatServiceDeps["runnerFor"];
 } & Pick<RouteHelpers, "readJson">): {
-    prepareSpec: (req: IncomingMessage, res: ServerResponse, bodyIn?: TaskRequestBody, onTypedFailure?: (err: HttpError) => void, legFacts?: {
+    prepareSpec: (req: IncomingMessage, res: ServerResponse, bodyIn?: TaskRequestBody, onTypedFailure?: (err: HttpError) => void, legRoute?: {
         liveStream?: boolean;
     }) => Promise<PreparedTaskSubmission | null>;
 };

package/dist/http/admission.js

@@ -20,6 +20,7 @@ import { echoCallerText, quotedCallerText } from "../caller-text-echo.js";
 import { MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
+import { legFactsOf } from "../leg-facts.js";
 import { resolveExecutionContext, stampSpecRoot } from "./execution-context.js";
 import { callerTrust, requestTrustRefusal } from "./caller-trust.js";
 import { createRunAcceptance } from "../run-acceptance.js";
@@ -115,7 +116,7 @@ function hostPathListRefusal(field, raw) {
 const modelIdOf = (model) => (typeof model === "string" ? model : model?.id);
 export function createAdmission(ctx) {
     const { deps, readJson, runnerFor } = ctx;
-    async function prepareSpec(req, res, bodyIn, onTypedFailure, legFacts) {
+    async function prepareSpec(req, res, bodyIn, onTypedFailure, legRoute) {
         const body = bodyIn ?? (await readJson(req));
         {
             const refusal = refuseSubmitBody(sqlWallsOf(deps.sqlEngine), body);
@@ -744,13 +745,16 @@ export function createAdmission(ctx) {
             const auth = await deps.authorize({ req, body: admitted });
             const execution = await resolveExecutionContext(deps, { kind: "fresh", root: auth.sessionId, principal: auth.principal, judged: auth.head, req, deviceId: admitted.deviceId });
             const engineNotices = [];
-            const spec = stampSpecRoot(await deps.resolveSpec(admitted, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n), lease, execution }), execution);
+            const resolved = await deps.resolveSpec(admitted, req, auth, { leg: "fresh", ...(legRoute?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n), lease, execution });
+            const facts = legFactsOf(resolved);
+            const runner = runnerFor(resolved);
+            const spec = stampSpecRoot(resolved, execution);
             const model = modelIdOf(spec.model);
             const acceptance = createRunAcceptance({ sessionTitler: deps.sessionTitler }, { sessionId: spec.sessionId, objective: spec.objective, ...(model !== undefined ? { model } : {}) });
             const clampNotice = buildEntryModeClampNotice(entryMode, spec.sessionId);
             const pendingNotices = clampNotice !== undefined ? [clampNotice, ...engineNotices] : engineNotices;
             const warnings = allowSelectorWarningsOf(admitted, spec.tools ?? []);
-            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, peerLease: lease, execution, ...(pendingNotices.length > 0 ? { engineNotices: pendingNotices } : {}), ...(warnings.length > 0 ? { warnings } : {}) };
+            return { spec, runner, legFacts: facts, auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, peerLease: lease, execution, ...(pendingNotices.length > 0 ? { engineNotices: pendingNotices } : {}), ...(warnings.length > 0 ? { warnings } : {}) };
         }
         catch (err) {
             lease.release();

package/dist/http/approval-sweeps.js

@@ -83,26 +83,29 @@ export function createApprovalSweeps(ctx) {
         const parkSources = deps.backgroundAgentStore !== undefined || deps.workflowAgentSessionIndex !== undefined;
         const cardOf = async (sessionId) => {
             let token;
+            let binding = {};
             try {
                 token = (await cs.findPendingTokenBySession(sessionId, undefined, { gateKinds: APPROVAL_GATE_KINDS })) ?? undefined;
                 if (!token)
-                    return { token, parked: false, rev: undefined };
+                    return { token, parked: false, rev: undefined, binding };
                 const cp = await cs.get(token);
                 if (!cp)
-                    return { token, parked: false, rev: undefined };
+                    return { token, parked: false, rev: undefined, binding };
+                const pa = cp.pendingAction;
+                binding = { checkpointToken: token, ...(pa.kind === "tool_approval" ? { boundCallId: pa.toolCallId, boundInputHash: pa.boundInputHash } : {}) };
                 const rev = checkpointRevOf(cp);
                 if (!parkSources)
-                    return { token, parked: false, rev };
+                    return { token, parked: false, rev, binding };
                 const origin = await findParkOrigin({
                     ...(deps.backgroundAgentStore !== undefined ? { agentStore: deps.backgroundAgentStore } : {}),
                     ...(deps.workflowAgentSessionIndex !== undefined && deps.workflowRunStore !== undefined
                         ? { workflowIndex: deps.workflowAgentSessionIndex, workflowRunStore: deps.workflowRunStore }
                         : {}),
                 }, { token, scope: cp.scope, sessionId: cp.sessionId });
-                return { token, parked: origin !== undefined, rev };
+                return { token, parked: origin !== undefined, rev, binding };
             }
             catch {
-                return { token, parked: false, rev: undefined };
+                return { token, parked: false, rev: undefined, binding };
             }
         };
         const storedBodyUnservable = async (sessionId) => {
@@ -140,7 +143,7 @@ export function createApprovalSweeps(ctx) {
         const replaySkipped = [];
         const seenCards = new Set();
         for (const { sessionId } of expired) {
-            const { token: cardToken, parked, rev: cardRev } = await cardOf(sessionId);
+            const { token: cardToken, parked, rev: cardRev, binding: cardBinding } = await cardOf(sessionId);
             if (cardToken !== undefined)
                 seenCards.add(cardToken);
             if (parked) {
@@ -154,7 +157,7 @@ export function createApprovalSweeps(ctx) {
             }
             let out;
             try {
-                out = await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied", { decidedBy: "sla_timeout" });
+                out = await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied", { decidedBy: "sla_timeout" }, undefined, undefined, cardBinding);
             }
             catch (e) {
                 deps.logger?.warn?.("deny_sweep_resume_failed", { sessionId, err: errText(e) });
@@ -228,7 +231,7 @@ export function createApprovalSweeps(ctx) {
             ...(req.gateBoundInputHash !== null ? { boundInputHash: req.gateBoundInputHash } : {}),
             ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
         };
-        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.decidedBy, req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
+        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.decider, req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
         return { status: out.status, body: out.body };
     }
     return { denyExpiredApprovals, redeemParkedAsk };

package/dist/http/caller-trust.d.ts

@@ -3,7 +3,7 @@
  *
  * ## 律
  * 契约(settings-schema `SAFETY_MERGE_SPEC.permissions` 的成员阶梯)按**层的信任档**准入每个成员:`allow` 放宽免问面(`loosen`),要 `global`;`deny` / `ask` 只收紧,
- * 文件层最低档 `local` 就收。准入不读层:提交体是合并后的结果,层只在合并端(cli 本地)存在;deny / ask 条目可以带出处层(`{ rule, layer }`),但那个层只选这条规则的
+ * 文件层最低档 `local` 就收。准入不读层:提交体是合并后的结果,层只在合并端(cli 本地)存在;三桶的条目可以带出处层(`{ rule, layer }`),但那个层只选这条规则的
  * `/` 读在哪个根(`permission-rule-list.ts` 的 `layerRuleRoot`),自报的层不可验、**不进本判**。所以本服务准入的「层」= **这次请求验过的凭据**:档只由部署形 + 身份来源
  * + 登录令牌的 scope 角色推,调用方说什么(含条目上的层)都不改档。
  *

package/dist/http/dispatch.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { setSsoPrincipal, setSsoScope, setSsoRole, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
+import { setSsoPrincipal, setSsoScope, setSsoRole, setSsoPrincipalInc, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import { admitBridgeIdentity } from "../auth-bridge.js";
@@ -227,6 +227,8 @@ export function createDispatch(ctx) {
                     setSsoScope(req, identity.scope);
                     if (identity.role)
                         setSsoRole(req, identity.role);
+                    if (identity.principalInc !== undefined)
+                        setSsoPrincipalInc(req, identity.principalInc);
                     deps.logger?.info?.("auth_bridge_principal_accepted", { principal: identity.principal, scope: identity.scope });
                 }
             }
@@ -236,7 +238,7 @@ export function createDispatch(ctx) {
         if (await dispatchSegment(PUBLIC_ROUTES, req, res, url, search, method, allow.pre, ctx))
             return;
         const identitySource = verifiedIdentitySource(req, deps.config);
-        admitRunIdentity(req, identitySource);
+        admitRunIdentity(req, identitySource, deps.logger);
         let source = null;
         const anyServiceAuth = hasServiceAuth(deps.config);
         if (anyServiceAuth) {

package/dist/http/durable-run-leg.js

@@ -15,7 +15,7 @@ import { persistSubmitCtx } from "./submit-ctx.js";
 import { releaseClaimedRun } from "./claimed-run.js";
 import { serviceVersion } from "../service-version.js";
 import { headReadOf } from "../session-incarnation.js";
-import { createSessionWorkspaceRecorder, legSessionWitnessOf, sessionWorkspaceStoreOf } from "../session-workspace.js";
+import { createSessionWorkspaceRecorder, sessionWorkspaceStoreOf } from "../session-workspace.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { deps } = ctx;
     const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
@@ -97,7 +97,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
             declaredFamilies: declaredApprovalFrameFamilies(args.prepared.body.settings),
             executionLane: args.prepared.execution.lane,
         }
-        : undefined, deps.checkpointStore, args.prepared.engineNotices, trustedInternals, deps.userInputLedger, args.prepared.acceptance, createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), legSessionWitnessOf(args.prepared.spec))));
+        : undefined, deps.checkpointStore, args.prepared.engineNotices, trustedInternals, deps.userInputLedger, args.prepared.acceptance, createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), args.prepared.legFacts?.sessionWitness), args.prepared.legFacts?.skills));
     return { status: 202, body: { taskId, sessionId, status: "running", ...(args.prepared.warnings !== undefined ? { warnings: args.prepared.warnings } : {}) } };
 }
 //# sourceMappingURL=durable-run-leg.js.map

package/dist/http/engine-refusal.d.ts

@@ -0,0 +1,16 @@
+import type { Refusal } from "./refusal-body.js";
+/** 一只引擎拒的应答:状态(出自 {@link resumeAtHttpStatus} 的单表)+ 拒(码 / 句,交 `sendError` 渲)。 */
+export interface EngineRefusalAnswer {
+    readonly status: number;
+    readonly refusal: Refusal;
+}
+/**
+ * 一只抛出的引擎拒按提交腿同一张表读成应答;不是登记过的拒 ⇒ `undefined`。
+ * 组句与同步腿零工作拒体同形(`http/routes/tasks.ts` 的 `syncRefusalHttpStatus` 臂):码经 {@link outwardPlane}(词法外的码折叠)与 {@link httpErrorCode},
+ * 句经出口座的 `peer-declaration-sentence` 一行出门(引擎判官对 MCP 声明说的句子,逐字带着声明方写的名字;座读本仓脱敏器〔`trace/redact.ts`〕的提案跨度 —— 提交腿上同一句
+ * 过的 `redactErrorMessage` 读的是同一只脱敏器);两条腿的同码同状态同句由 `test/prepare-refusal-one-http-shape.test.ts` ⑤ 钉住。
+ * ⚠️ 唯一的字面差:提交腿的句子在这之前还过引擎自己把抛出物折成终局句的那一道出口过滤,读面的句子没有(本仓不调引擎的脱敏函数,台账 skip 行)——
+ * 句子里若出现凭据形的拼写,两面都把它盖住、字节都不外露,只是记号的写法不同(引擎 `[redacted]` / 本服务 `«redacted:…»`)。
+ */
+export declare function engineRefusalAnswerOf(err: unknown): EngineRefusalAnswer | undefined;
+//# sourceMappingURL=engine-refusal.d.ts.map

package/dist/http/engine-refusal.js

@@ -0,0 +1,17 @@
+import { errorCodeOf, errorText } from "../observability/err-text.js";
+import { resumeAtHttpStatus } from "../runs.js";
+import { outwardPlane } from "../terminal.js";
+import { seatText } from "../trace/exit-seat.js";
+import { httpErrorCode } from "./send.js";
+export function engineRefusalAnswerOf(err) {
+    const code = errorCodeOf(err);
+    if (code === undefined)
+        return undefined;
+    const terminal = { kind: "failed", code, message: errorText(err) };
+    const status = resumeAtHttpStatus({ terminal });
+    if (status === undefined)
+        return undefined;
+    const plane = outwardPlane(terminal);
+    return { status, refusal: { errorCode: httpErrorCode(status, plane.errorCode), message: seatText("peer-declaration-sentence", plane.errorMessage ?? "engine refusal") } };
+}
+//# sourceMappingURL=engine-refusal.js.map

package/dist/http/execution-context.d.ts

@@ -85,8 +85,8 @@ export type ExecutionContext = {
 export type RootedExecutionContext = Extract<ExecutionContext, {
     readonly root: string;
 }>;
-/** 装配器(`resolveSpec`)收的那一半:根与入口形(它不判放置、不选车道)。 */
-export type ExecutionRoot = Pick<RootedExecutionContext, "kind" | "root">;
+/** 装配器(`resolveSpec`)收的那一半:根、入口形与解析器选定的车道(它不判放置、不选车道 —— `lane` 是解析器那一次的读数,装配器只读:项目包的车道门)。 */
+export type ExecutionRoot = Pick<RootedExecutionContext, "kind" | "root" | "lane">;
 /** 解析器读的部署件(全部取自同一只 `ServiceDeps`)。 */
 export interface ExecutionContextDeps {
     readonly config: ServiceConfig;

package/dist/http/idempotency.d.ts

@@ -117,7 +117,7 @@ export declare function inflightKeyOf(idem: RunIdemBinding, face: SubmitReplayFa
  * 再走 `/v1/tasks`,合流到的是前者的那份结局。回执若铸在同步腿的体里,这条**确实产了帧**的 run 在非流式面上
  * 就成了「键缺席」,而 present-iff 的读法会把它读成「这台引擎不给回执」。挂在 outcome 上 = 它是**这条 run 的
  * 属性**(哪条腿跑的都一样),由各腿自己的应答构造器在送出那一刻按自己的 wire 形挂。
- * 落定之后的同键重放不走这里:它读行,体是 run 行读面 + `replay: true`(`http/submit-replay.ts`)—— 回执是起手那一帧
+ * 落定之后的同键重放不走这里:它读行,体是首答的信封 + `replay: true`(`http/submit-replay.ts` → `http/sync-submit-body.ts`)—— 回执是起手那一帧
  * 的活捕获、不落行,所以重放体上**不带** `wiringManifest`(`replay: true` 就是那一形的判别位)。
  *
  * 🔴 **租户面安全(别在复审里当成漏)**:合流的那份回执是按**第一位调用方**的 `explicitOperatorOk` 投的,

package/dist/http/memory-compliance-failure-reply.d.ts

@@ -8,9 +8,7 @@
  * core 的另外三只 409 与 `ControlPlaneCorruptError` 全落 500 `internal.error` —— 「同一个 requestId 拿去抹另一个会话」这种**调用方自己
  * 能改**的错被说成服务器坏了。两份分类 = 两个判官,少的那份恒是静默的一份。现在**码与状态**只在这里判一次,两面同读。
  *
- * ## 规则(三层,与 operator 面既有层序逐字同序;另有本服务自铸的一只,先判)
- *  ⓪ 本服务的抹除店护栏拒 {@link MemoryErasureStoreUnjudged} —— 409 `memory.erasure_store_unjudged`(抹除落到部署的店之外的那只店:本部署此刻判不了
- *     同一个 `requestId` 跨店的幂等;什么都没删)。文案按受众,同下一节的规则;
+ * ## 规则(三层,与 operator 面既有层序逐字同序)
  *  ① core 的**本口专属**码(闭集穷举 `switch`,见 {@link sentCoreCode})—— 码与状态两面同;文案按受众(下一节,一条规则);
  *  ② **店形拒**两码 `memory.target_outside_store`(core 7.31.1 [ref])/ `memory.scope_home_not_directory`(core 7.44.0 [ref])—— 跨面 store 状态码,409、码原样
  *     (判据 `memory-store-refusal.ts` 一只;运维行 `memory_store_form_refused { code, path?, form? }` 两受众同一只铸点,路径只在那里);