@sema-agent/server 7.142.0 → 7.144.0

package/dist/tool-approval.js

@@ -1,5 +1,5 @@
 import { readApprovalCard } from "./approval-content-kind.js";
-import { heldAskOf, liveSettledBy, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "./host-decision.js";
+import { heldAskOf, liveHostSource, readDecider, retiredDecisionKeyFacts, POLICY_CANNOT_ALLOW_PERSON_ASK } from "./host-decision.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7, classifyAsk, foldArbitrationRow, policyCannotAnswer, screenAskClassMembers, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
@@ -12,14 +12,14 @@ import { createLogger } from "./observability/logger.js";
 import { errorKindOf } from "./observability/err-text.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { ownerOfCheckpointScope } from "./security.js";
-import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS, noteLandedOnRow, noteRecordedReceipt } from "./approval-ask-machine.js";
-import { currentParkArm, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildReplayFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readStoredCardEnvelope, readRuleEvidence, readAllowRuleShadowed, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, buildApprovalCompleteFrame, readRuleOfferList, } from "./approval-card.js";
+import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS, noteLandedOnRow, noteRecordedReceipt, readBoundInputHash } from "./approval-ask-machine.js";
+import { askDemandsAPerson, storedPersonDemandRecord, currentParkArm, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, adoptStoredLiveFacts, buildApprovalRequestFrame, buildReplayFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readStoredCardEnvelope, readRuleEvidence, readAllowRuleShadowed, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readAskReasons, readClosedWordSeat, buildApprovalCompleteFrame, readRuleOfferList, } from "./approval-card.js";
 import { askOwnerAdmits, askRowCarriesOwner, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { APPROVAL_ENDING_CAUSES, SETTLE_OUTCOME, askRowEndingCause, askRowParkTrigger } from "./approval-deny-reasons.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 import { governanceOriginOf } from "./runtime-governance.js";
-import { grantBindingOf } from "./standing-answer-grant.js";
+import { agreedGrantBinding, grantBindingOf } from "./standing-answer-grant.js";
 import { operatorAsk } from "./operator-ask.js";
 import { APPROVAL_EXEMPTED_EVENT } from "./plugins/approval-exemption-store.js";
 import { refusalBody } from "./http/refusal-body.js";
@@ -47,7 +47,7 @@ export function approvalDecidePath(sessionId) {
     return `/v1/approvals/${encodeURIComponent(sessionId)}/decide`;
 }
 function parkSessionOf(row) {
-    return row.sourceTaskId === row.sessionId && row.sessionId !== row.taskId ? row.sessionId : undefined;
+    return row.sourceSessionId === row.sessionId && row.sessionId !== row.taskId ? row.sessionId : undefined;
 }
 function ruleMaterialCarriesCredentialShape(command) {
     return redactSecretsWithArms(command, { observe: false }).arms.has("full");
@@ -119,7 +119,7 @@ function askStandingAnswerFacts(req, governanceForced, deploymentListAsks) {
     const deploymentListQuestion = carriesDeploymentListQuestion(deploymentListAsks, classes);
     return {
         governanceForced,
-        requiresRealApproval: req.requiresRealApproval === true,
+        requiresRealApproval: askDemandsAPerson(req, undefined),
         mandated: req.mandated === true,
         grantBinding: grantBindingOf(req),
         classes,
@@ -136,7 +136,7 @@ export function carriesDeploymentListQuestion(deploymentListAsks, classes) {
 export function policyAskStandingAnswerFacts(req, ask, deploymentListQuestion) {
     return {
         governanceForced: false,
-        requiresRealApproval: ask.requiresRealApproval === true,
+        requiresRealApproval: askDemandsAPerson(ask, undefined),
         mandated: ask.mandated === true,
         grantBinding: grantBindingOf(req),
         classes: [...classifyAsk(ask, noGateFacts({ toolCallId: req.toolCallId, toolName: req.toolName })).classes],
@@ -190,6 +190,29 @@ function pendingEntryStandingAnswerFacts(entry) {
         deploymentListQuestion: entry.deploymentListQuestion === true,
     };
 }
+function projectDecisionFacts(facts, frame, card) {
+    const rememberRefused = standingAnswerHome(facts) === "none";
+    if (frame !== undefined) {
+        if (facts.requiresRealApproval)
+            frame.requiresRealApproval = true;
+        else
+            delete frame.requiresRealApproval;
+        if (rememberRefused)
+            frame.rememberRefused = true;
+        else
+            delete frame.rememberRefused;
+    }
+    if (card === undefined)
+        return undefined;
+    let out = card;
+    if (out.risk.requiresRealApproval !== facts.requiresRealApproval)
+        out = { ...out, risk: { ...out.risk, requiresRealApproval: facts.requiresRealApproval } };
+    if ((out.rememberRefused === true) !== rememberRefused) {
+        const { rememberRefused: _stale, ...rest } = out;
+        out = rememberRefused ? { ...rest, rememberRefused: true } : rest;
+    }
+    return out;
+}
 function mandatedFromSeat(seat) {
     switch (seat.state) {
         case "word":
@@ -223,10 +246,11 @@ function livePendingRowOf(e) {
         ...(e.sessionId !== undefined ? { sessionId: e.sessionId } : {}),
         ...(e.requiresRealApproval ? { requiresRealApproval: true } : {}),
         ...(e.governanceForced ? { governanceForced: true } : {}),
-        ...(e.mandated ? { mandated: true } : {}),
+        ...(listFrame.mandated === true ? { mandated: true } : {}),
         ...(standingAnswerHome(pendingEntryStandingAnswerFacts(e)) === "none" ? { rememberRefused: true } : {}),
-        ...(e.mandate !== undefined ? { mandate: e.mandate } : {}),
-        ...(e.origin !== undefined ? { origin: e.origin } : {}),
+        ...(listFrame.mandate !== undefined ? { mandate: listFrame.mandate } : {}),
+        ...(listFrame.origin !== undefined ? { origin: listFrame.origin } : {}),
+        ...(listFrame.type === "approval_request" && listFrame.liveFactsUnknown === true ? { liveFactsUnknown: true } : {}),
         ...(e.originTaskId !== undefined ? { fromSubagent: true, originTaskId: e.originTaskId } : {}),
         ...(approvalCard !== undefined ? { approvalCard } : {}),
         frame: listFrame,
@@ -294,17 +318,17 @@ function parseToolApprovalFields(body, retired) {
         }
         if (retired !== undefined)
             return { ok: false, error: retired.error };
-        const decidedByReading = readDecidedBy(body.decidedBy, false);
-        let decidedBy;
-        switch (decidedByReading.kind) {
+        const deciderReading = readDecider(body, false);
+        let decider;
+        switch (deciderReading.kind) {
             case "outside_closed_set":
-                return { ok: false, error: DECIDED_BY_OUTSIDE_CLOSED_SET };
+                return { ok: false, error: deciderReading.message };
             case "accepted":
-                decidedBy = decidedByReading.decidedBy;
+                decider = deciderReading.decider;
                 break;
             default: {
-                const unreachable = decidedByReading;
-                throw new Error(`unhandled decidedBy reading: ${JSON.stringify(unreachable)}`);
+                const unreachable = deciderReading;
+                throw new Error(`unhandled decider reading: ${JSON.stringify(unreachable)}`);
             }
         }
         const rawGrant = body.readRootGrant;
@@ -319,7 +343,7 @@ function parseToolApprovalFields(body, retired) {
             ...(d !== "deny" && u !== undefined ? { updatedInput: u } : {}),
             ...(persistRule !== undefined ? { persistRule } : {}),
             ...(note !== undefined ? { note } : {}),
-            decidedBy,
+            decider,
             ...(readRootGrant !== undefined ? { readRootGrant } : {}),
         };
     }
@@ -357,12 +381,6 @@ function boundArgs(args) {
     }
     return { args: redacted, omitted: false, hasBidi };
 }
-function readBoundInputHash(req) {
-    if (req === null || typeof req !== "object")
-        return null;
-    const v = Reflect.get(req, "boundInputHash");
-    return typeof v === "string" && v.length > 0 ? v : null;
-}
 export function resolveStreamApprovalGate(input) {
     if (!input.toolApprovalEnabled)
         return { active: false, reason: "no_tool_approval" };
@@ -492,7 +510,7 @@ function replayTerminalAskRow(row) {
 }
 export function outcomeOfDecidedRow(row) {
     const allow = row.decision === "approve";
-    const source = row.settledBy !== null ? { settledBy: row.settledBy } : {};
+    const source = row.settledBy !== null ? { settledBy: row.settledBy, ...(row.decidedVia !== null ? { decidedVia: row.decidedVia } : {}) } : {};
     const edit = allow && row.updatedInput !== undefined ? { updatedInput: row.updatedInput } : {};
     return row.settledBy === null && !("updatedInput" in edit) ? allow : { allow, ...edit, ...source };
 }
@@ -502,7 +520,7 @@ function settleArgsOfDecided(outcome) {
     return {
         allowed: outcome.allow,
         ...(outcome.updatedInput !== undefined ? { updatedInput: outcome.updatedInput } : {}),
-        ...(outcome.settledBy !== undefined ? { settledBy: outcome.settledBy } : {}),
+        ...(outcome.settledBy !== undefined ? { source: { settledBy: outcome.settledBy, ...(outcome.decidedVia !== undefined ? { decidedVia: outcome.decidedVia } : {}) } } : {}),
     };
 }
 function verdictOfDecided(args) {
@@ -510,7 +528,7 @@ function verdictOfDecided(args) {
         by: "human",
         allowed: args.allowed,
         ...(args.updatedInput !== undefined ? { updatedInput: args.updatedInput } : {}),
-        ...(args.settledBy !== undefined ? { hostSettledBy: args.settledBy } : {}),
+        ...(args.source !== undefined ? { hostSource: args.source } : {}),
     };
 }
 function settleArgsOf(outcome) {
@@ -633,8 +651,8 @@ export class ToolApprovalCoordinator {
     get unattendedRoutesToPark() {
         return this.unattendedPolicy !== "deny";
     }
-    batchIdFor(askId, sourceTaskId, runId, legKey) {
-        return this.unattendedRoutesToPark ? deriveBatchId(sourceTaskId, runId, legKey) : deriveAskScopedBatchId(askId);
+    batchIdFor(askId, sourceSessionId, runId, legKey) {
+        return this.unattendedRoutesToPark ? deriveBatchId(sourceSessionId, runId, legKey) : deriveAskScopedBatchId(askId);
     }
     unattendedAskOutcome(site) {
         const facts = {
@@ -1024,7 +1042,7 @@ export class ToolApprovalCoordinator {
     async sessionGrantUncontestedByRow(origin, req) {
         if (!this.askStore)
             return true;
-        const call = { taskId: origin.taskId, legKey: origin.legKey, toolCallId: req.toolCallId, sourceTaskId: req.sourceTaskId ?? origin.taskId };
+        const call = { taskId: origin.taskId, legKey: origin.legKey, toolCallId: req.toolCallId, sourceSessionId: req.sourceSessionId ?? origin.taskId };
         try {
             const rows = await this.withStoreDeadline(this.askStore.listByCall(call), "listByCall(session-grant-provenance)", DURABLE_CONVERGE_READ_TIMEOUT_MS);
             return rows.length === 0;
@@ -1330,6 +1348,7 @@ export class ToolApprovalCoordinator {
         const cardWord = readApprovalCard(req.approvalCard);
         const originWord = typeof req.origin === "string" && req.origin.length > 0 ? req.origin : undefined;
         const askClassPair = readAskClassPair(req);
+        const askReasonsOfReq = readAskReasons(req);
         const requester = extensionRequesterOf(req.requestedBy, "tool_approval");
         const frame = {
             type: "tool_approval",
@@ -1338,7 +1357,7 @@ export class ToolApprovalCoordinator {
             ...(typeof req.toolCallId === "string" && req.toolCallId !== "" ? { toolCallId: req.toolCallId } : {}),
             ...(child
                 ? {
-                    sourceTaskId: req.sourceTaskId,
+                    sourceSessionId: req.sourceSessionId,
                     fromSubagent: true,
                     ...(typeof req.sourceAgentName === "string" ? { sourceAgentName: redactSecrets(req.sourceAgentName) } : {}),
                     ...(req.delegation
@@ -1352,9 +1371,10 @@ export class ToolApprovalCoordinator {
                         : {}),
                 }
                 : {}),
+            ...(typeof req.agentId === "string" && req.agentId !== "" ? { agentId: req.agentId } : {}),
             message: typeof req.message === "string" ? redactDeep(req.message) : "",
+            ...(askReasonsOfReq !== undefined ? { askReasons: askReasonsOfReq } : {}),
             ...(governanceForced ? { governanceForced: true } : {}),
-            ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(req.mandated === true ? { mandated: true } : {}),
             ...(standingAnswerHome(askStandingAnswerFacts(req, governanceForced, deploymentListAsks)) === "none" ? { rememberRefused: true } : {}),
             ...(typeof req.boundGrantDigest === "string" ? { boundGrantDigest: req.boundGrantDigest, ...(req.boundGrants !== undefined ? { boundGrants: req.boundGrants } : {}) } : {}),
@@ -1381,9 +1401,11 @@ export class ToolApprovalCoordinator {
         const expiresAtMs = Math.ceil(Date.now() + effectiveWindowMs);
         let askId;
         let batchId;
-        const card = this.askStore ? buildApprovalCard(frame, req, req.requiresRealApproval === true) : undefined;
+        const card = this.askStore ? buildApprovalCard(frame, req, askDemandsAPerson(req, undefined)) : undefined;
         let cardForFrame = card;
         let persistedExpiresAtMs = expiresAtMs;
+        let factsOfRecord;
+        let recordCard;
         let entryExecutionLane = origin.executionLane;
         let lateEnsuredRow;
         let lateTerminalRow;
@@ -1412,16 +1434,16 @@ export class ToolApprovalCoordinator {
                 : replayed;
         };
         if (this.askStore && card) {
-            const sourceTaskId = req.sourceTaskId ?? origin.taskId;
+            const sourceSessionId = req.sourceSessionId ?? origin.taskId;
             const runId = origin.taskId;
             const legKey = origin.legKey;
-            askId = deriveAskId(sourceTaskId, runId, legKey, req);
-            batchId = this.batchIdFor(askId, sourceTaskId, runId, legKey);
+            askId = deriveAskId(sourceSessionId, runId, legKey, req);
+            batchId = this.batchIdFor(askId, sourceSessionId, runId, legKey);
             try {
                 const existingOrCreated = await this.withStoreDeadline(this.askStore.ensureAsk({
                     askId,
                     taskId: origin.taskId,
-                    sourceTaskId,
+                    sourceSessionId,
                     sessionId: origin.sessionId ?? origin.taskId,
                     owner: origin.owner,
                     executionLane: origin.executionLane,
@@ -1429,7 +1451,7 @@ export class ToolApprovalCoordinator {
                     toolCallId: req.toolCallId,
                     legKey,
                     parentToolCallId: req.delegation?.parentToolCallId ?? null,
-                    cardJson: buildApprovalCardEnvelope(askId, card),
+                    cardJson: buildApprovalCardEnvelope(askId, card, frame),
                     boundInputHash: readBoundInputHash(req),
                     ...durableRuleMaterial(ruleLaneMaterial),
                     schemaVersion: 1,
@@ -1463,6 +1485,10 @@ export class ToolApprovalCoordinator {
                 persistedExpiresAtMs = existingOrCreated.row.expiresAtMs;
                 entryExecutionLane = existingOrCreated.row.executionLane;
                 cardForFrame = persistedEnvelope.card;
+                recordCard = persistedEnvelope.card;
+                factsOfRecord = existingOrCreated.inserted ? undefined : persistedEnvelope.liveFacts;
+                if (factsOfRecord !== undefined)
+                    adoptStoredLiveFacts(frame, factsOfRecord);
                 if (cardForFrame.governanceForced === true)
                     frame.governanceForced = true;
                 else
@@ -1508,6 +1534,8 @@ export class ToolApprovalCoordinator {
                         confirmedRowExists = confirmedRow !== null;
                         if (confirmedRow !== null)
                             batchId = confirmedRow.batchId;
+                        if (confirmedRow !== null)
+                            recordCard = storedPersonDemandRecord(confirmedRow.cardJson);
                         indeterminate = false;
                         break;
                     }
@@ -1560,7 +1588,7 @@ export class ToolApprovalCoordinator {
             if (hostSettled !== undefined || (denyReasonSettled !== undefined && denyReasonSettled !== "")) {
                 return {
                     allow: false,
-                    ...(hostSettled !== undefined ? { settledBy: hostSettled } : {}),
+                    ...hostSettled,
                     ...(denyReasonSettled !== undefined && denyReasonSettled !== "" ? { reason: denyReasonSettled } : {}),
                 };
             }
@@ -1577,7 +1605,7 @@ export class ToolApprovalCoordinator {
                 return {
                     allow: true,
                     ...(settled.updatedInput !== undefined ? { updatedInput: settled.updatedInput } : {}),
-                    ...(hostSettled !== undefined ? { settledBy: hostSettled } : {}),
+                    ...hostSettled,
                     ...(settled.readRootGrant !== undefined ? { readRootGrant: settled.readRootGrant } : {}),
                 };
             }
@@ -1589,10 +1617,10 @@ export class ToolApprovalCoordinator {
             done = true;
             const allowed = verdict.by === "human" && verdict.allowed;
             const outcome = verdict.by === "system" ? SETTLE_OUTCOME.EXPIRED : verdict.allowed ? SETTLE_OUTCOME.ALLOWED : SETTLE_OUTCOME.DENIED;
-            const hostSettledBy = verdict.hostSettledBy;
+            const hostSource = verdict.hostSource;
             const updatedInput = verdict.by === "human" ? verdict.updatedInput : undefined;
             const readRootGrant = verdict.by === "human" ? verdict.readRootGrant : undefined;
-            hostSettled = hostSettledBy;
+            hostSettled = hostSource;
             denyReasonSettled = verdict.by === "human" && !verdict.allowed ? verdict.denyReason : undefined;
             if (timer)
                 clearTimeout(timer);
@@ -1626,7 +1654,7 @@ export class ToolApprovalCoordinator {
                 const common = {
                     approvalId: wireApprovalId,
                     ...(windowRouteUnavailable ? { parkRouted: true } : {}),
-                    ...(hostSettledBy !== undefined ? { settledBy: hostSettledBy } : {}),
+                    ...(hostSource !== undefined ? { settledBy: hostSource.settledBy } : {}),
                     settledAtMs: Date.now(),
                 };
                 return verdict.by === "system"
@@ -1638,7 +1666,7 @@ export class ToolApprovalCoordinator {
                     approvalId: wireApprovalId,
                     taskId: origin.taskId,
                     carrierLeg,
-                    executingSessionId: req.sourceTaskId,
+                    executingSessionId: req.sourceSessionId,
                     toolCallId: req.toolCallId,
                     settleRecord,
                 });
@@ -1792,7 +1820,7 @@ export class ToolApprovalCoordinator {
             if (done)
                 return;
             windowRouteUnavailable = true;
-            settle({ by: "system", cause, ...(hostSettledBy !== undefined ? { hostSettledBy } : {}) });
+            settle({ by: "system", cause, ...(hostSettledBy !== undefined ? { hostSource: { settledBy: hostSettledBy } } : {}) });
         };
         const windowExpired = (hostSelfReport, cause) => {
             void (async () => {
@@ -1901,23 +1929,18 @@ export class ToolApprovalCoordinator {
         }
         const entryClasses = askClassPair?.classes;
         const entryDeploymentListQuestion = carriesDeploymentListQuestion(deploymentListAsks, entryClasses);
-        const entryGrantBinding = grantBindingOf(req);
-        const rememberRefused = standingAnswerHome(pendingEntryStandingAnswerFacts({
+        const legGrantBinding = grantBindingOf(req);
+        const entryGrantBinding = factsOfRecord === undefined ? legGrantBinding : agreedGrantBinding(legGrantBinding, grantBindingOf(factsOfRecord));
+        const entryMandated = req.mandated === true || factsOfRecord?.mandated === true;
+        const entryDemandsAPerson = askDemandsAPerson(req, recordCard) || [...(askId !== undefined ? (this.pendingByAskId.get(askId) ?? []) : [])].some((s) => s.requiresRealApproval === true);
+        cardForFrame = projectDecisionFacts(pendingEntryStandingAnswerFacts({
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
-            ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-            ...(req.mandated === true ? { mandated: true } : {}),
+            ...(entryDemandsAPerson ? { requiresRealApproval: true } : {}),
+            ...(entryMandated ? { mandated: true } : {}),
             grantBinding: entryGrantBinding,
             classes: entryClasses,
             ...(entryDeploymentListQuestion ? { deploymentListQuestion: true } : {}),
-        })) === "none";
-        if (rememberRefused)
-            frame.rememberRefused = true;
-        else
-            delete frame.rememberRefused;
-        if (cardForFrame !== undefined && (cardForFrame.rememberRefused === true) !== rememberRefused) {
-            const { rememberRefused: _stale, ...cardRest } = cardForFrame;
-            cardForFrame = rememberRefused ? { ...cardRest, rememberRefused: true } : cardRest;
-        }
+        }), frame, cardForFrame);
         const cardFrame = askId !== undefined && cardForFrame !== undefined
             ? buildApprovalRequestFrame({ askId, taskId: origin.taskId, approvalId: wireApprovalId, card: cardForFrame, expiresAtMs: persistedExpiresAtMs, nowMs: Date.now(), live: frame })
             : undefined;
@@ -1928,7 +1951,7 @@ export class ToolApprovalCoordinator {
             owner: origin.owner,
             ...(primary ? { ctxTaskId: primary.taskId, originCtx: primary } : {}),
             ...(reachability === "unreached" ? { suspended: true } : {}),
-            ...(child ? { originTaskId: req.sourceTaskId } : primary ? { targetCtxs: new Set(aliveCtxs), onTargetGone } : {}),
+            ...(child ? { originTaskId: req.sourceSessionId } : primary ? { targetCtxs: new Set(aliveCtxs), onTargetGone } : {}),
             ...(origin.sessionId ? { sessionId: origin.sessionId } : {}),
             frame,
             ...(cardFrame !== undefined ? { cardFrame } : {}),
@@ -1943,10 +1966,8 @@ export class ToolApprovalCoordinator {
             executionLane: entryExecutionLane,
             ...(ruleLaneMaterial !== undefined ? { ruleLane: ruleLaneMaterial } : {}),
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
-            ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-            ...(req.mandated === true ? { mandated: true } : {}),
-            ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
-            ...(originWord !== undefined ? { origin: originWord } : {}),
+            ...(entryDemandsAPerson ? { requiresRealApproval: true } : {}),
+            ...(entryMandated ? { mandated: true } : {}),
             ...(askId !== undefined && batchId !== undefined ? { askId, batchId } : {}),
         };
         selfEntry = pendingEntry;
@@ -1959,11 +1980,21 @@ export class ToolApprovalCoordinator {
                 this.pendingByAskId.set(askId, siblings);
             }
             siblings.add(pendingEntry);
+            if (entryDemandsAPerson) {
+                for (const s of siblings) {
+                    if (s.requiresRealApproval === true)
+                        continue;
+                    s.requiresRealApproval = true;
+                    const card = projectDecisionFacts(pendingEntryStandingAnswerFacts(s), s.frame, s.cardFrame?.card);
+                    if (s.cardFrame !== undefined && card !== undefined && card !== s.cardFrame.card)
+                        s.cardFrame = { ...s.cardFrame, card };
+                }
+            }
         }
         this.askAudit?.recordAsk({
             approvalId: wireApprovalId,
             taskId: origin.taskId,
-            ...(req.sourceTaskId !== undefined ? { sourceTaskId: req.sourceTaskId } : {}),
+            ...(req.sourceSessionId !== undefined ? { sourceSessionId: req.sourceSessionId } : {}),
             ...(origin.sessionId !== undefined ? { sessionId: origin.sessionId } : {}),
             owner: origin.owner,
             toolName: req.toolName,
@@ -2123,7 +2154,7 @@ export class ToolApprovalCoordinator {
         const preRule = this.precheckEditedRuleBeforeDecision(entry, judgedOwner, parsed);
         if (preRule !== undefined)
             return preRule;
-        if (parsed.value !== "deny" && policyCannotAnswer(heldAskOf(entry.requiresRealApproval === true), parsed.decidedBy)) {
+        if (parsed.value !== "deny" && policyCannotAnswer(heldAskOf(entry.requiresRealApproval === true), parsed.decider.decidedBy)) {
             return { status: 400, body: refusalBody({ errorCode: "request.body_shape", message: POLICY_CANNOT_ALLOW_PERSON_ASK }) };
         }
         const ruleEligibility = { eligible: true };
@@ -2486,7 +2517,7 @@ export class ToolApprovalCoordinator {
                     gateBoundInputHash: row.gateBoundInputHash,
                     decision,
                     ...(parsed.note !== undefined ? { note: parsed.note } : {}),
-                    decidedBy: parsed.decidedBy,
+                    decider: parsed.decider,
                     ...(parsed.updatedInput !== undefined && parsed.value !== "deny" ? { updatedInput: parsed.updatedInput } : {}),
                     ...(principal !== undefined ? { principal } : {}),
                     ...(httpReq !== undefined ? { httpReq } : {}),
@@ -2729,7 +2760,7 @@ export class ToolApprovalCoordinator {
                 decision: parsed.value === "deny" ? "deny" : "approve",
                 ...(parsed.note !== undefined ? { decisionNote: parsed.note } : {}),
                 ...(parsed.value !== "deny" && parsed.updatedInput !== undefined ? { updatedInput: parsed.updatedInput } : {}),
-                ...((sb) => (sb !== undefined ? { settledBy: sb } : {}))(liveSettledBy(parsed.decidedBy)),
+                ...liveHostSource(parsed.decider),
             }), "decideAsk", DURABLE_CALL_TIMEOUT_MS, (late) => {
                 if (late.ok)
                     this.notifyExternalDecision(askId, outcomeOfDecidedRow(late.row));
@@ -2809,13 +2840,13 @@ export class ToolApprovalCoordinator {
             this.allowAllSessions.add(sessionAllowKey(judgedOwner, entry.sessionId, sessionAllowCategory(entry.toolName), entry.grantBinding));
         }
         const allowed = parsed.value !== "deny";
-        const settleArgs = opts?.settleOutcome !== undefined ? settleArgsOfDecided(opts.settleOutcome) : { allowed, updatedInput: parsed.updatedInput, settledBy: liveSettledBy(parsed.decidedBy) };
+        const settleArgs = opts?.settleOutcome !== undefined ? settleArgsOfDecided(opts.settleOutcome) : { allowed, updatedInput: parsed.updatedInput, source: liveHostSource(parsed.decider) };
         const readRootGrant = opts?.settleOutcome === undefined || opts.settleOutcomeIsThisRequest === true ? parsed.readRootGrant : undefined;
         entry.settle({
             by: "human",
             allowed: settleArgs.allowed,
             updatedInput: settleArgs.updatedInput,
-            ...(settleArgs.settledBy !== undefined ? { hostSettledBy: settleArgs.settledBy } : {}),
+            ...(settleArgs.source !== undefined ? { hostSource: settleArgs.source } : {}),
             ...(!settleArgs.allowed && parsed.note !== undefined ? { denyReason: parsed.note } : {}),
             ...(readRootGrant !== undefined ? { readRootGrant } : {}),
         });
@@ -2870,7 +2901,8 @@ export class ToolApprovalCoordinator {
         const registrationId = uuidv7();
         const facts = {
             ...(card.governanceForced === true ? { governanceForced: true } : {}),
-            ...(card.risk.requiresRealApproval ? { requiresRealApproval: true } : {}),
+            ...(askDemandsAPerson(undefined, card) ? { requiresRealApproval: true } : {}),
+            ...(replayFrame.mandated === true ? { mandated: true } : {}),
             grantBinding: { kind: "unreadable" },
             ...(card.classes !== undefined ? { classes: card.classes } : {}),
         };
@@ -2905,7 +2937,7 @@ export class ToolApprovalCoordinator {
             owner: row.owner,
             executionLane: row.executionLane,
             ...(row.sessionId !== row.taskId ? { sessionId: row.sessionId } : {}),
-            ...(card.fromSubagent === true ? { originTaskId: row.sourceTaskId } : {}),
+            ...(card.fromSubagent === true ? { originTaskId: row.sourceSessionId } : {}),
             toolName: card.toolName,
             ...facts,
             approvalId: row.askId,
@@ -2962,10 +2994,16 @@ export class ToolApprovalCoordinator {
         }
         return rows;
     }
-    hasLivePendingFrom(originTaskId) {
-        for (const e of this.pending.values())
-            if (e.originTaskId === originTaskId && e.adopted !== true)
+    hasLivePendingFromLeg(names) {
+        if (names.length === 0)
+            return false;
+        for (const e of this.pending.values()) {
+            if (e.adopted === true)
+                continue;
+            const { agentId, sourceSessionId } = e.frame;
+            if ((agentId !== undefined && names.includes(agentId)) || (sourceSessionId !== undefined && names.includes(sourceSessionId)))
                 return true;
+        }
         return false;
     }
     async pollSuspendedDecisions() {

package/dist/trace/core-keyset-guard.d.ts

@@ -17,7 +17,7 @@
  * ⑨⑩([ref],2026-08-31)把两个最大的 wire 面也纳入:TaskSpec 按「server 有无写点」记 Wired/Unwired,
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
-import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, SideQueryResult, WiringManifest, PermissionModeReceipt, GateOutcome, GateDisposition, Settlement, PausedCause, TerminalCause, CheckpointGate, CheckpointToken, VerificationResult, CascadeRunResult, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps, SessionMemoryStatus, PromptManifestIdentity, PromptIdentityLayers, PromptManifestSelectors, PromptManifestSection, PromptChainLink, SupersededOverlay, ToolDisclosureManifest } from "@sema-agent/core";
+import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, SideQueryResult, WiringManifest, PermissionModeReceipt, GateOutcome, GateDisposition, Settlement, PausedCause, TerminalCause, CheckpointGate, CheckpointToken, VerificationResult, CascadeRunResult, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps, SessionMemoryStatus, DeploymentSessionMemoryStatus, PromptManifestIdentity, PromptIdentityLayers, PromptManifestSelectors, PromptManifestSection, PromptChainLink, SupersededOverlay, ToolDisclosureManifest } from "@sema-agent/core";
 import type { ToolApprovalFrame } from "../tool-approval.js";
 import type { TableCoreKeys } from "./projection-table.js";
 import type { PauseSeat } from "../terminal.js";
@@ -45,7 +45,7 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "approvalCard" | "boundGrantAbsence" | "requestedBy";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceSessionId" | "agentId" | "askReasons" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "approvalCard" | "boundGrantAbsence" | "requestedBy";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy" | "editRewritten";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
@@ -217,8 +217,8 @@ type _GuardPromptManifestKeysReverse = AssertAllKeysHandled<{
 type _GuardPromptManifestKeysNonEmpty = AssertAllKeysHandled<{
     [L in keyof ManifestCore]: [ManifestDeclared<ManifestFaces, L>] extends [never] ? L : never;
 }[keyof ManifestCore]>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence" | "checkpointId";
-type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "approvalCard" | "restoreMode" | "previewWithheld" | "authoredBy" | "runOrigin" | "requestedByCallId";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence" | "checkpointId" | "rowVerdict";
+type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceSessionId" | "agentId" | "approvalCard" | "restoreMode" | "previewWithheld" | "authoredBy" | "runOrigin" | "requestedByCallId";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
 type ParkArmKeys = keyof Extract<PendingAction, {
@@ -234,7 +234,7 @@ type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requi
 export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "modelRole" | "enableBlockedReport" | "promptForm" | "advisorModel" | "runOrigin" | "planFile" | "classifyAllShell";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
-type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction" | "resultEntryIds";
+type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction" | "resultEntryIds" | "placementRoot";
 type TaskResultStripped = never;
 type _GuardTaskResult = AssertAllKeysHandled<Exclude<keyof TaskResult, TaskResultForwarded | TaskResultStripped>>;
 type _GuardTaskResultReverse = AssertAllKeysHandled<Exclude<TaskResultForwarded | TaskResultStripped, keyof TaskResult>>;
@@ -245,7 +245,7 @@ type _GuardPausedCauseReverse = AssertAllKeysHandled<Exclude<PausedCauseForwarde
 type NonPausedTerminalKeys = Exclude<TerminalCause, {
     kind: "paused";
 }> extends infer C ? (C extends object ? keyof C : never) : never;
-type TerminalArmForwarded = "kind" | "code" | "message" | "nestedPause" | "detail" | "reason";
+type TerminalArmForwarded = "kind" | "code" | "message" | "nestedPause" | "detail" | "reason" | "unstartedRow";
 type TerminalArmStripped = never;
 type _GuardTerminalArm = AssertAllKeysHandled<Exclude<NonPausedTerminalKeys, TerminalArmForwarded | TerminalArmStripped>>;
 type _GuardTerminalArmReverse = AssertAllKeysHandled<Exclude<TerminalArmForwarded | TerminalArmStripped, NonPausedTerminalKeys>>;
@@ -433,10 +433,12 @@ type _CoverWordsCheck = AssertAllKeysHandled<Exclude<CoveringWords<{
 }, _CoverProbeWords>> | Exclude<"text[]" | "tree", CoveringWords<readonly string[] | undefined, _CoverProbeWords>> | Extract<"verbatim" | "text[]", CoveringWords<{
     note: string;
 }[], _CoverProbeWords>>>;
+type SessionMemoryStatusSourceKey = keyof SessionMemoryStatus | keyof DeploymentSessionMemoryStatus;
 type SessionMemoryStatusProjected = "captureOptedOut" | "committedCount" | "foldedCount" | "optOutSource" | "lastCaptureAt";
-type SessionMemoryStatusExcluded = "writeHome";
-type _GuardSessionMemoryStatus = AssertAllKeysHandled<Exclude<keyof SessionMemoryStatus, SessionMemoryStatusProjected | SessionMemoryStatusExcluded>>;
-type _GuardSessionMemoryStatusReverse = AssertAllKeysHandled<Exclude<SessionMemoryStatusProjected | SessionMemoryStatusExcluded, keyof SessionMemoryStatus>>;
+type SessionMemoryStatusExcluded = "writeHome" | "planes";
+type _GuardSessionMemoryStatus = AssertAllKeysHandled<Exclude<SessionMemoryStatusSourceKey, SessionMemoryStatusProjected | SessionMemoryStatusExcluded>>;
+type _GuardSessionMemoryStatusReverse = AssertAllKeysHandled<Exclude<SessionMemoryStatusProjected | SessionMemoryStatusExcluded, SessionMemoryStatusSourceKey>>;
+type _GuardSessionMemoryStatusDeploymentReverse = AssertAllKeysHandled<Exclude<SessionMemoryStatusProjected, keyof DeploymentSessionMemoryStatus>>;
 type SideQueryResultForwarded = "text" | "toolCalls" | "model" | "servedModel" | "degraded" | "responseModel" | "usage" | "usageMissing" | "stopReason" | "errorMessage" | "errorCode" | "errorKind" | "inputTooLongRuledOut" | "account";
 type SideQueryResultStripped = never;
 type _GuardSideQueryResult = AssertAllKeysHandled<Exclude<keyof SideQueryResult, SideQueryResultForwarded | SideQueryResultStripped>>;
@@ -525,6 +527,7 @@ export type CoreKeysetGuards = [
     _GuardTerminalArmReverse,
     _GuardSessionMemoryStatus,
     _GuardSessionMemoryStatusReverse,
+    _GuardSessionMemoryStatusDeploymentReverse,
     _GuardNotificationReverse,
     _GuardProvenance,
     _GuardProvenanceReverse,

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.image_removed", "mcp.authorization_required"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.lineage_rerooted", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.media_removed", "mcp.authorization_required", "classifier.seat_rate_limited", "context.tool_schema_removed"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;

package/dist/trace/engine-notice-wire.js

@@ -28,7 +28,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "approval.read_root_granted",
     "approval.read_root_grant_rejected",
     "instructions.source_changed",
-    "session.records_skipped",
+    "session.lineage_rerooted",
     "server.model_unreachable",
     "permission.entry_mode_clamped",
     "classifier.unavailable",
@@ -47,8 +47,10 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "advisor.not_attached",
     "inherit_env.names_withheld",
     "model.capability_downgraded",
-    "context.image_removed",
+    "context.media_removed",
     "mcp.authorization_required",
+    "classifier.seat_rate_limited",
+    "context.tool_schema_removed",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {