@sema-agent/server 7.148.0 → 7.150.0

package/dist/tool-approval.js

@@ -37,7 +37,7 @@ const ADOPT_OPEN_ASKS_MAX = 1_000;
 const EDITED_DECISION_MARK_CAP_MS = 10_000;
 const DEFAULT_WINDOW_MARGIN_MS = 10_000;
 const SHUTDOWN_DRAIN_POLL_MS = 50;
-const MAX_ALLOW_SESSIONS = 4096;
+export const MAX_ALLOW_SESSIONS = 4096;
 const DEFAULT_ADMIT_MAX_PER_TASK = 32;
 const DEFAULT_ADMIT_MAX_PER_OWNER = 256;
 const DEFAULT_PARK_REDEMPTION_MAX = 2000;
@@ -115,8 +115,28 @@ const FS_WRITE_TOOLS = pathConfinableWriteToolNames();
 function sessionAllowCategory(toolName) {
     return FS_WRITE_TOOLS.has(toolName) ? "fs-write" : `tool:${toolName}`;
 }
-function sessionAllowKey(owner, sessionId, category, binding) {
-    return JSON.stringify([owner, sessionId, category, binding.kind === "bound" ? binding.digest : null]);
+function sessionAllowKey(owner, seat, category, binding) {
+    return JSON.stringify([owner, seat.sessionId, seat.incarnation, category, binding.kind === "bound" ? binding.digest : null]);
+}
+function sessionAllowSeatOf(leg) {
+    return leg.sessionId && leg.incarnation ? { sessionId: leg.sessionId, incarnation: leg.incarnation } : undefined;
+}
+function liveSessionAnswer(facts, leg) {
+    const home = standingAnswerHome(facts);
+    switch (home) {
+        case "none":
+            return { home: "none", occupantUnreadable: false };
+        case "seat": {
+            const seat = sessionAllowSeatOf(leg);
+            return seat !== undefined ? { home: "seat", seat } : { home: "none", occupantUnreadable: Boolean(leg.sessionId) };
+        }
+        case "server_store":
+            return leg.sessionId ? { home: "server_store", sessionId: leg.sessionId } : { home: "none", occupantUnreadable: false };
+        default: {
+            const unhandled = home;
+            throw new Error(`unhandled standing-answer home: ${String(unhandled)}`);
+        }
+    }
 }
 function askStandingAnswerFacts(req, governanceForced, deploymentListAsks) {
     const classes = screenAskClassMembers(req.askClass, req.classes)?.classes;
@@ -194,8 +214,8 @@ function pendingEntryStandingAnswerFacts(entry) {
         deploymentListQuestion: entry.deploymentListQuestion === true,
     };
 }
-function projectDecisionFacts(facts, frame, card) {
-    const rememberRefused = standingAnswerHome(facts) === "none";
+function projectDecisionFacts(facts, leg, frame, card) {
+    const rememberRefused = liveSessionAnswer(facts, leg).home === "none";
     if (frame !== undefined) {
         if (facts.requiresRealApproval)
             frame.requiresRealApproval = true;
@@ -227,9 +247,6 @@ function mandatedFromSeat(seat) {
             return false;
     }
 }
-function rowOrUnknown(read) {
-    return read.kind === "row" ? read.row : null;
-}
 function askRowVisibleTo(row, principal) {
     return row !== null && askOwnerAdmitsAnswer(row.owner, principal);
 }
@@ -257,7 +274,7 @@ function livePendingRowOf(e) {
         ...(e.requiresRealApproval ? { requiresRealApproval: true } : {}),
         ...(e.governanceForced ? { governanceForced: true } : {}),
         ...(listFrame.mandated === true ? { mandated: true } : {}),
-        ...(standingAnswerHome(pendingEntryStandingAnswerFacts(e)) === "none" ? { rememberRefused: true } : {}),
+        ...(liveSessionAnswer(pendingEntryStandingAnswerFacts(e), e).home === "none" ? { rememberRefused: true } : {}),
         ...(listFrame.mandate !== undefined ? { mandate: listFrame.mandate } : {}),
         ...(listFrame.origin !== undefined ? { origin: listFrame.origin } : {}),
         ...(listFrame.type === "approval_request" && listFrame.liveFactsUnknown === true ? { liveFactsUnknown: true } : {}),
@@ -960,7 +977,8 @@ export class ToolApprovalCoordinator {
         const sessionId = origin.sessionId;
         if (!sessionId)
             return false;
-        const live = this.allowAllSessions.has(sessionAllowKey(origin.owner, sessionId, sessionAllowCategory(req.toolName), facts.grantBinding));
+        const seat = sessionAllowSeatOf(origin);
+        const live = seat !== undefined && this.allowAllSessions.has(sessionAllowKey(origin.owner, seat, sessionAllowCategory(req.toolName), facts.grantBinding));
         const durable = !live && facts.grantBinding.kind === "none" && (await this.durableGrantHas(sessionId, req.toolName));
         if (!live && !durable)
             return false;
@@ -984,7 +1002,14 @@ export class ToolApprovalCoordinator {
     }
     boundUnattendedAsk = (identity, why) => {
         return async (req) => {
-            const origin = { owner: identity.owner, taskId: identity.taskId, ...(identity.sessionId !== undefined ? { sessionId: identity.sessionId } : {}), legKey: "", executionLane: identity.executionLane };
+            const origin = {
+                owner: identity.owner,
+                taskId: identity.taskId,
+                ...(identity.sessionId !== undefined ? { sessionId: identity.sessionId } : {}),
+                legKey: "",
+                executionLane: identity.executionLane,
+                ...(identity.incarnation !== undefined ? { incarnation: identity.incarnation } : {}),
+            };
             if (await this.standingGrantSettles(origin, req, this.governanceForcedOf(origin, req)))
                 return true;
             return this.unattendedAskOutcome({ ...why, taskId: identity.taskId, owner: identity.owner, toolName: req.toolName });
@@ -1230,6 +1255,7 @@ export class ToolApprovalCoordinator {
             ...(ctx.sessionId !== undefined ? { sessionId: ctx.sessionId } : {}),
             legKey: ctx.legKey ?? "",
             executionLane: ctx.executionLane,
+            ...(ctx.incarnation !== undefined ? { incarnation: ctx.incarnation } : {}),
             ...(ctx.legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic: ctx.legDeadlineMonotonic } : {}),
         }, [ctx], req, signal);
     };
@@ -1243,6 +1269,7 @@ export class ToolApprovalCoordinator {
                 ...(identity.sessionId !== undefined ? { sessionId: identity.sessionId } : {}),
                 legKey: identity.legKey ?? "",
                 executionLane: identity.executionLane,
+                ...(identity.incarnation !== undefined ? { incarnation: identity.incarnation } : {}),
                 ...(identity.legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic: identity.legDeadlineMonotonic } : {}),
             }, live, req, signal);
         };
@@ -1321,7 +1348,7 @@ export class ToolApprovalCoordinator {
             ...(askReasonsOfReq !== undefined ? { askReasons: askReasonsOfReq } : {}),
             ...(governanceForced ? { governanceForced: true } : {}),
             ...(req.mandated === true ? { mandated: true } : {}),
-            ...(standingAnswerHome(askStandingAnswerFacts(req, governanceForced, deploymentListAsks)) === "none" ? { rememberRefused: true } : {}),
+            ...(liveSessionAnswer(askStandingAnswerFacts(req, governanceForced, deploymentListAsks), origin).home === "none" ? { rememberRefused: true } : {}),
             ...(typeof req.boundGrantDigest === "string" ? { boundGrantDigest: req.boundGrantDigest, ...(req.boundGrants !== undefined ? { boundGrants: req.boundGrants } : {}) } : {}),
             ...(noRulingCause !== undefined ? { classifierNoRuling: noRulingCause } : {}),
             ...(grantAbsence !== undefined ? { boundGrantAbsence: grantAbsence } : {}),
@@ -1888,7 +1915,7 @@ export class ToolApprovalCoordinator {
             grantBinding: entryGrantBinding,
             classes: entryClasses,
             ...(entryDeploymentListQuestion ? { deploymentListQuestion: true } : {}),
-        }), frame, cardForFrame);
+        }), origin, frame, cardForFrame);
         const cardFrame = askId !== undefined && cardForFrame !== undefined
             ? buildApprovalRequestFrame({ askId, taskId: origin.taskId, approvalId: wireApprovalId, card: cardForFrame, expiresAtMs: persistedExpiresAtMs, nowMs: Date.now(), live: frame })
             : undefined;
@@ -1902,6 +1929,7 @@ export class ToolApprovalCoordinator {
             ...(reachability === "unreached" ? { suspended: true } : {}),
             ...(child ? { originTaskId: req.sourceSessionId } : primary ? { targetCtxs: new Set(aliveCtxs), onTargetGone } : {}),
             ...(origin.sessionId ? { sessionId: origin.sessionId } : {}),
+            ...(origin.incarnation !== undefined ? { incarnation: origin.incarnation } : {}),
             frame,
             ...(cardFrame !== undefined ? { cardFrame } : {}),
             approvalId: wireApprovalId,
@@ -1934,7 +1962,7 @@ export class ToolApprovalCoordinator {
                     if (s.requiresRealApproval === true)
                         continue;
                     s.requiresRealApproval = true;
-                    const card = projectDecisionFacts(pendingEntryStandingAnswerFacts(s), s.frame, s.cardFrame?.card);
+                    const card = projectDecisionFacts(pendingEntryStandingAnswerFacts(s), s, s.frame, s.cardFrame?.card);
                     if (s.cardFrame !== undefined && card !== undefined && card !== s.cardFrame.card)
                         s.cardFrame = { ...s.cardFrame, card };
                 }
@@ -2058,10 +2086,7 @@ export class ToolApprovalCoordinator {
         const store = this.askStore;
         if (!store)
             return this.askNotVisible();
-        const readSeq = this.nextRowReadSeq();
-        const row = rowOrUnknown(await this.askRowFor(store, id, "getAsk(respond-by-row)"));
-        if (row?.state === "STREAM_PENDING")
-            this.followRowOwner(row.askId, row.owner, readSeq);
+        const row = await this.askRowFollowingOwner(store, id, "getAsk(respond-by-row)");
         if (!askRowVisibleTo(row, principal))
             return this.askNotVisible();
         if (row.state !== "STREAM_PENDING")
@@ -2090,11 +2115,10 @@ export class ToolApprovalCoordinator {
     }
     recordDeploymentListAnswer(decided, entry, judgedOwner, parsed, principal, eligibility) {
         const store = this.sessionGrants;
-        const sessionId = entry.sessionId;
-        if (parsed.value !== "allow_session" || !sessionId || store === undefined)
-            return decided;
-        if (standingAnswerHome(pendingEntryStandingAnswerFacts(entry)) !== "server_store")
+        const answer = liveSessionAnswer(pendingEntryStandingAnswerFacts(entry), entry);
+        if (parsed.value !== "allow_session" || answer.home !== "server_store" || store === undefined)
             return decided;
+        const sessionId = answer.sessionId;
         return (async () => {
             const result = await decided;
             if (result.status !== 200)
@@ -2175,17 +2199,7 @@ export class ToolApprovalCoordinator {
         const store = this.askStore;
         if (!store)
             return this.askNotVisible();
-        const readSeq = this.nextRowReadSeq();
-        const read = await this.askRowFor(store, id, "getAsk(read-by-row)");
-        if (read.kind === "unreadable") {
-            if (entry.adopted === true || !askOwnerAdmitsAnswer(entry.owner, principal))
-                return this.askNotVisible();
-            const body = { state: "pending", ...livePendingRowOf(entry) };
-            return { status: 200, body };
-        }
-        const row = rowOrUnknown(read);
-        if (row?.state === "STREAM_PENDING")
-            this.followRowOwner(row.askId, row.owner, readSeq);
+        const row = await this.askRowFollowingOwner(store, id, "getAsk(read-by-row)");
         if (askRowVisibleTo(row, principal) && row.state === "STREAM_PENDING") {
             const body = { state: "pending", ...livePendingRowOf(entry) };
             return { status: 200, body };
@@ -2193,7 +2207,7 @@ export class ToolApprovalCoordinator {
         return this.readStateOfRow(row, principal);
     }
     async readAskRowState(store, id, principal) {
-        return this.readStateOfRow(rowOrUnknown(await this.askRowFor(store, id, "getAsk(read)")), principal);
+        return this.readStateOfRow(await this.askRowFor(store, id, "getAsk(read)"), principal);
     }
     async readParkedGate(row) {
         const gate = this.parkedGate;
@@ -2350,18 +2364,24 @@ export class ToolApprovalCoordinator {
         return undefined;
     }
     async dispatchLateByRow(store, id, parsed, httpReq, principal) {
-        return this.dispatchRowTruth(rowOrUnknown(await this.askRowFor(store, id, "getAsk(respond-late)")), id, parsed, httpReq, principal);
+        return this.dispatchRowTruth(await this.askRowFor(store, id, "getAsk(respond-late)"), id, parsed, httpReq, principal);
     }
     async askRowFor(store, id, label) {
         try {
-            const row = await this.withStoreDeadline(store.getAsk(id), label, DURABLE_CONVERGE_READ_TIMEOUT_MS);
-            return row === null ? { kind: "absent" } : { kind: "row", row };
+            return await this.withStoreDeadline(store.getAsk(id), label, DURABLE_CONVERGE_READ_TIMEOUT_MS);
         }
         catch (err) {
             this.noteStoreError(err, label);
-            return { kind: "unreadable" };
+            return null;
         }
     }
+    async askRowFollowingOwner(store, id, label) {
+        const readSeq = this.nextRowReadSeq();
+        const row = await this.askRowFor(store, id, label);
+        if (row?.state === "STREAM_PENDING")
+            this.followRowOwner(row.askId, row.owner, readSeq);
+        return row;
+    }
     async dispatchRowTruth(row, id, parsed, httpReq, principal) {
         if (!askRowVisibleTo(row, principal))
             return this.askNotVisible();
@@ -2778,30 +2798,21 @@ export class ToolApprovalCoordinator {
     }
     finishRespond(entry, judgedOwner, parsed, opts) {
         let rememberApplied;
-        const home = standingAnswerHome(pendingEntryStandingAnswerFacts(entry));
-        let grantable;
-        switch (home) {
-            case "seat":
-                grantable = true;
-                break;
-            case "none":
-            case "server_store":
-                grantable = false;
-                break;
-            default: {
-                const unhandled = home;
-                throw new Error(`unhandled standing-answer home: ${String(unhandled)}`);
+        if (parsed.value === "allow_session") {
+            const answer = liveSessionAnswer(pendingEntryStandingAnswerFacts(entry), entry);
+            rememberApplied = answer.home === "seat";
+            if (answer.home === "seat") {
+                const grantKey = sessionAllowKey(judgedOwner, answer.seat, sessionAllowCategory(entry.toolName), entry.grantBinding);
+                if (this.allowAllSessions.size >= MAX_ALLOW_SESSIONS) {
+                    const oldest = this.allowAllSessions.values().next().value;
+                    if (oldest !== undefined)
+                        this.allowAllSessions.delete(oldest);
+                }
+                this.allowAllSessions.add(grantKey);
             }
-        }
-        if (parsed.value === "allow_session")
-            rememberApplied = Boolean(entry.sessionId) && grantable;
-        if (parsed.value === "allow_session" && entry.sessionId && grantable) {
-            if (this.allowAllSessions.size >= MAX_ALLOW_SESSIONS) {
-                const oldest = this.allowAllSessions.values().next().value;
-                if (oldest !== undefined)
-                    this.allowAllSessions.delete(oldest);
+            else if (answer.home === "none" && answer.occupantUnreadable) {
+                defaultLogger.warn("session_grant_refused_occupant_unreadable", { sessionId: entry.sessionId, toolName: entry.toolName });
             }
-            this.allowAllSessions.add(sessionAllowKey(judgedOwner, entry.sessionId, sessionAllowCategory(entry.toolName), entry.grantBinding));
         }
         const allowed = parsed.value !== "deny";
         const settleArgs = opts?.settleOutcome !== undefined
@@ -2872,7 +2883,8 @@ export class ToolApprovalCoordinator {
             grantBinding: { kind: "unreadable" },
             ...(card.classes !== undefined ? { classes: card.classes } : {}),
         };
-        const rememberRefused = standingAnswerHome(pendingEntryStandingAnswerFacts(facts)) === "none";
+        const leg = row.sessionId !== row.taskId ? { sessionId: row.sessionId } : {};
+        const rememberRefused = liveSessionAnswer(pendingEntryStandingAnswerFacts(facts), leg).home === "none";
         const cardFrame = (card.rememberRefused === true) === rememberRefused
             ? replayFrame
             : { ...replayFrame, card: rememberRefused ? { ...card, rememberRefused: true } : (({ rememberRefused: _stale, ...rest }) => rest)(card) };
@@ -2903,7 +2915,7 @@ export class ToolApprovalCoordinator {
             owner: row.owner,
             ownerReadSeq: this.rowReadSeq,
             executionLane: row.executionLane,
-            ...(row.sessionId !== row.taskId ? { sessionId: row.sessionId } : {}),
+            ...leg,
             ...(card.fromSubagent === true ? { originTaskId: row.sourceSessionId } : {}),
             toolName: card.toolName,
             ...facts,
@@ -2979,18 +2991,29 @@ export class ToolApprovalCoordinator {
                 n += 1;
         return n;
     }
-    listLivePending(scope) {
-        const rows = [];
+    async listLivePending(scope) {
         const owner = scope === undefined ? undefined : ownerOfCheckpointScope(scope);
-        const seen = new Set();
-        for (const e of this.pending.values()) {
-            if (owner !== undefined && e.owner !== owner)
-                continue;
-            if (seen.has(e.approvalId))
-                continue;
-            seen.add(e.approvalId);
-            rows.push(livePendingRowOf(e));
-        }
+        const inScope = (rowOwner) => owner === undefined || rowOwner === owner;
+        const candidates = new Map();
+        for (const e of this.pending.values())
+            if (!candidates.has(e.approvalId))
+                candidates.set(e.approvalId, e);
+        const store = this.askStore;
+        const ids = [...candidates.keys()];
+        const listed = await Promise.all([...candidates.values()].map(async (entry) => {
+            if (store === undefined || !this.registrationHasRow(entry))
+                return inScope(entry.owner);
+            const ask = await this.askRowFollowingOwner(store, entry.askId, "getAsk(list-live)");
+            return ask?.state === "STREAM_PENDING" && inScope(ask.owner);
+        }));
+        const rows = [];
+        ids.forEach((id, i) => {
+            if (!listed[i])
+                return;
+            const current = this.liveEntryFor(id);
+            if (current !== undefined)
+                rows.push(livePendingRowOf(current));
+        });
         return rows;
     }
     hasLivePendingFromLeg(names) {

package/dist/trace/engine-notice-wire.d.ts

@@ -1,3 +1,4 @@
+import { projectMcpAuthorization } from "../mcp-authorization-face.js";
 /**
  * 上 wire 的通告码 —— **显式闭集常量表**(设计稿 ①,起步三码;今天的码数以本常量自身为准——
  * 在散文里抄数字必陈腐,codex 5.65 增量批 R1-[low] 实逮:上一句曾写「今天九码」而表里是十条。
@@ -16,7 +17,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.lineage_rerooted", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.media_removed", "mcp.authorization_required", "classifier.seat_rate_limited", "context.tool_schema_removed", "memory.harvest_refused", "memory.harvest_conflict", "config.legacy_tool_name"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.lineage_rerooted", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.media_removed", "mcp.authorization_required", "classifier.seat_rate_limited", "context.tool_schema_removed", "memory.harvest_refused", "memory.harvest_conflict", "config.legacy_tool_name", "config.read_deny_floor_unkept"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;
@@ -108,6 +109,19 @@ export declare function redactNoticeMessage(message: unknown): string;
  * 交中和形,空白 / 超长的条目两只码不同)。其余字段、其余码原样。
  */
 export declare function redactNoticeRuleText(code: string, detail: Record<string, unknown> | undefined): Record<string, unknown> | undefined;
+/**
+ * 通告 `detail` 里**平铺着一条有处置表的记录**的码:码 → 那条记录的成员名与出门投影(一张表,不在 {@link engineNoticeEventData} 里写分支)。
+ * 记录成员只经那只投影出门(结构位:不过 {@link sanitizeWireText} 的脱敏与截断 —— 结构位的形与长由记录的属主判);detail 的其余成员照旧经
+ * {@link sanitizeNoticeDetail},合并按引擎 detail 的原键序。投影答 `undefined`(`reason` 出闭集 / 缺席)⇒ 记录成员整组缺席(在场而读不出由表的丢弃口计一次),
+ * 与状态面「整格缺席」同一失败方向。
+ * 运维日志腿(`boot/runner-deps.ts` 的转发席)不读这张登记:日志答「发生了什么」(给运维,整行过日志行的出口座),wire 答「用户拿到什么」—— 两个问题,两个读者。
+ */
+export declare const NOTICE_DETAIL_RECORDS: {
+    readonly "mcp.authorization_required": {
+        readonly members: readonly string[];
+        readonly project: typeof projectMcpAuthorization;
+    };
+};
 export declare function engineNoticeEventData(notice: {
     code: string;
     message: string;
@@ -121,6 +135,17 @@ export declare function engineNoticeEventData(notice: {
 export type EngineNoticeWireSink = (row: EngineNoticeWireRow) => unknown;
 /** 口的槽位(闭集):`live` = 流上的人(SSE),`durable` = 这条 run 的事件账。{@link EngineNoticeRouter.routeConfirmed} 只数 `durable` 槽的落账确认。 */
 export type EngineNoticeSlot = "live" | "durable";
+/**
+ * 分流器收的通告形:引擎的四键(`code` / `message` / `detail` / 顶层 `sessionId`)加本服务的一只**投递键** `taskId` ——
+ * 在场 = 这条通告说的是哪一条 run(run 资源 id),只投给登记了同一条 run 的腿;缺席 = 按会话投(引擎的通告都不带它)。投递键不上 wire(行里没有它)。
+ */
+export interface RoutedNotice {
+    readonly code: string;
+    readonly message: string;
+    readonly detail?: Record<string, unknown>;
+    readonly sessionId?: unknown;
+    readonly taskId?: unknown;
+}
 /** 一条腿的两只具名口(各自可缺席:bg 腿没有 live SSE,ephemeral sync 腿没有账本)。 */
 export interface EngineNoticeLegSlots {
     readonly live?: EngineNoticeWireSink;
@@ -142,6 +167,11 @@ export interface EngineNoticeLegSlots {
  * 药:每次 `registerLeg` 铸一个单调 legId,`route` **只投最新代**;旧代的口留在表里(它自己的注销仍
  * 按身份精确删,不会误删新代),但一帧都收不到。方向 = fail-closed(宁可旧腿少一帧,不可新腿的事实
  * 写进旧腿的账)。
+ *
+ * 🔴 **反方向同一条:点名了 run 的通告不进别的 run 的账**(投递键 `taskId`,{@link RoutedNotice})。本服务按腿作用域定归属的通告
+ * (`read-deny-floor-notice.ts`:腿派出去的 run 的那一帧)带上这条腿的 run;腿的作用域可以被续延留住(后台子代在腿收场之后才准备),
+ * 那一刻同会话的最新一代可能已是下一条 run ⇒ 最新一代登记的 run 不是点名的那一条 ⇒ 不投。腿登记时带它写的那条 run(`registerEngineNoticeLeg` 的 `taskId`);
+ * 引擎的通告不带投递键,照旧按会话投。
  */
 export declare class EngineNoticeRouter {
     private readonly legs;
@@ -150,7 +180,7 @@ export declare class EngineNoticeRouter {
      *
      * 每只口各自 try 隔离在 {@link route} 里,单口抛不牵连同腿另一口。
      */
-    registerLeg(sessionId: string, slots: EngineNoticeLegSlots): () => void;
+    registerLeg(sessionId: string, slots: EngineNoticeLegSlots, taskId?: string): () => void;
     /** 单口腿的便捷形(测试用):登记为 **durable** 槽 —— 这样 `route()` 与 `routeConfirmed()` 两条路都能用一只口测到(live 槽对后者结构上恒不计)。 */
     register(sessionId: string, sink: EngineNoticeWireSink): () => void;
     /** 诊断/门用:某会话此刻**最新代**有几只口在听(旧代不计——它们收不到帧)。 */
@@ -158,28 +188,18 @@ export declare class EngineNoticeRouter {
     /** 诊断/门用:某会话此刻有几代腿在表里(>1 = 正处在换代窗内)。 */
     legCount(sessionId: string): number;
     /**
-     * 分流器的 wire 半场。返回**真投出去的口数**(0 = 没投:非白名单码 / 缺 sessionId / 该会话无活跃腿)。
+     * 分流器的 wire 半场。返回**真投出去的口数**(0 = 没投:非白名单码 / 缺 sessionId / 该会话无活跃腿 / 点名的 run 不是最新一代登记的那一条)。
      *
      * 单只口抛错**不吃掉同腿的其它口**(fleet bus 订阅者隔离同理由),并按 F 类登记留痕。
      */
-    route(notice: {
-        code: string;
-        message: string;
-        detail?: Record<string, unknown>;
-        sessionId?: unknown;
-    }, nowMs?: number): number;
+    route(notice: RoutedNotice, nowMs?: number): number;
     /**
      * [ref](codex r1-F2 / r2-F1;[ref] opus 腿 L2 改按槽判):同一只扇出,但**等**每只口交回的持久化结果 —— 返回**确认落账**的口数:
      * 只数 **`durable` 槽**里交回 thenable 且兑现 `true` 的口;兑现 `false` / 拒绝不算;`live` 槽**结构上不计**(不管它返回什么 —— 流上的人收没收到说明不了落账;
      * 修前按「交回 thenable」反推是不是 durable 口,哪天 live 口改成 async 返回 `true` 就会被计成落账)。给「投出之后要记一笔『告知过』」的铸点用:
      * 记账必须跟在**落账**之后,不能跟在「调用了口」之后(后台腿唯一的口是事件账 append,写失败时 `route()` 的计数照样是 1)。判据(白名单 / 归属 / 最新代 / 隔离)与 `route()` 逐字同一条。
      */
-    routeConfirmed(notice: {
-        code: string;
-        message: string;
-        detail?: Record<string, unknown>;
-        sessionId?: unknown;
-    }, nowMs?: number): Promise<number>;
+    routeConfirmed(notice: RoutedNotice, nowMs?: number): Promise<number>;
     /** 两只入口共用的扇出:返回每只**没抛**的口的持久化结果(promise 形一律先接住拒绝 ⇒ 绝不留未处理拒绝)。 */
     private fanOut;
 }
@@ -197,6 +217,8 @@ export declare const defaultEngineNoticeRouter: EngineNoticeRouter;
  */
 export declare function registerEngineNoticeLeg(opts: {
     sessionId: string | undefined;
+    /** 这条腿写的那条 run(run 资源 id = 本腿 `spec.taskId`;没有 run 资源 ⇒ 缺席)—— 点名了 run 的通告只投给登记了同一条 run 的腿。 */
+    taskId?: string;
     live?: EngineNoticeWireSink;
     durable?: EngineNoticeWireSink;
     router?: EngineNoticeRouter;
@@ -210,11 +232,6 @@ export declare function registerEngineNoticeLeg(opts: {
      * `route()` 恒返 0 —— 一条结构上永远投不出去的用户面披露,就是本仓 `task.user_steer_undrained` 陈腐明拒
      * 那一族的病。缺席/空数组 ⇒ 一个字节不投(既有腿逐字不变)。
      */
-    pending?: readonly {
-        code: string;
-        message: string;
-        detail?: Record<string, unknown>;
-        sessionId?: unknown;
-    }[];
+    pending?: readonly RoutedNotice[];
 }): () => void;
 //# sourceMappingURL=engine-notice-wire.d.ts.map

package/dist/trace/engine-notice-wire.js

@@ -2,6 +2,7 @@ import { uuidv7 } from "@sema-agent/core";
 import { redactSecrets } from "./redact.js";
 import { redactListEntry } from "../list-entry-display.js";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { MCP_AUTHORIZATION_MEMBERS, projectMcpAuthorization } from "../mcp-authorization-face.js";
 export const ENGINE_NOTICE_WIRE_CODES = [
     "memory.session_polluted",
     "memory.harvest_quarantined",
@@ -54,6 +55,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "memory.harvest_refused",
     "memory.harvest_conflict",
     "config.legacy_tool_name",
+    "config.read_deny_floor_unkept",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {
@@ -135,11 +137,27 @@ export function redactNoticeRuleText(code, detail) {
     });
     return { ...detail, [at.array]: redacted };
 }
+export const NOTICE_DETAIL_RECORDS = {
+    "mcp.authorization_required": { members: MCP_AUTHORIZATION_MEMBERS, project: projectMcpAuthorization },
+};
+function noticeDetailOf(code, detail) {
+    const records = NOTICE_DETAIL_RECORDS;
+    const record = Object.hasOwn(records, code) ? records[code] : undefined;
+    if (record === undefined || detail === undefined)
+        return sanitizeNoticeDetail(redactNoticeRuleText(code, detail));
+    const own = (key) => record.members.includes(key);
+    const face = { ...record.project(Object.fromEntries(Object.entries(detail).filter(([k]) => own(k)))) };
+    const rest = sanitizeNoticeDetail(redactNoticeRuleText(code, Object.fromEntries(Object.entries(detail).filter(([k]) => !own(k)))));
+    return Object.fromEntries(Object.keys(detail).flatMap((k) => {
+        const from = own(k) ? face : rest;
+        return Object.hasOwn(from, k) ? [[k, from[k]]] : [];
+    }));
+}
 export function engineNoticeEventData(notice, sessionId, nowMs, eventId) {
     return {
         code: notice.code,
         message: redactNoticeMessage(notice.message).slice(0, NOTICE_TEXT_MAX),
-        detail: sanitizeNoticeDetail(redactNoticeRuleText(notice.code, notice.detail)),
+        detail: noticeDetailOf(notice.code, notice.detail),
         sessionId,
         ts: nowMs,
         eventId,
@@ -149,9 +167,9 @@ const isThenableResult = (v) => typeof v === "object" && v !== null && typeof v.
 let nextLegId = 1;
 export class EngineNoticeRouter {
     legs = new Map();
-    registerLeg(sessionId, slots) {
+    registerLeg(sessionId, slots, taskId) {
         const sinks = [...(slots.live ? [{ slot: "live", sink: slots.live }] : []), ...(slots.durable ? [{ slot: "durable", sink: slots.durable }] : [])];
-        const leg = { legId: nextLegId++, sinks };
+        const leg = { legId: nextLegId++, sinks, ...(taskId !== undefined && taskId.length > 0 ? { taskId } : {}) };
         const list = this.legs.get(sessionId) ?? [];
         list.push(leg);
         this.legs.set(sessionId, list);
@@ -197,6 +215,9 @@ export class EngineNoticeRouter {
         const leg = list && list.length > 0 ? list[list.length - 1] : undefined;
         if (!leg || leg.sinks.length === 0)
             return [];
+        const named = notice.taskId;
+        if (typeof named === "string" && named.length > 0 && leg.taskId !== named)
+            return [];
         const row = engineNoticeEventData(notice, sessionId, nowMs, uuidv7());
         const outcomes = [];
         for (const { slot, sink } of leg.sinks) {
@@ -219,7 +240,7 @@ export function registerEngineNoticeLeg(opts) {
     if (live === undefined && durable === undefined)
         return () => undefined;
     const router = opts.router ?? defaultEngineNoticeRouter;
-    const unregister = router.registerLeg(sessionId, { ...(live ? { live } : {}), ...(durable ? { durable } : {}) });
+    const unregister = router.registerLeg(sessionId, { ...(live ? { live } : {}), ...(durable ? { durable } : {}) }, opts.taskId);
     for (const notice of opts.pending ?? [])
         router.route(notice);
     return unregister;

package/dist/trace/ledger-sink.d.ts

@@ -69,7 +69,9 @@ export interface LedgerSink {
      *  The redaction owner is NOT this writer: it is `redactLedgerEventData` — the one confluence every ledger row
      *  crosses at the three store twins' `appendEvent` AND again on the read face (idempotent). Redacting here too
      *  would put two writers on one semantic surface; the other park writers (`http/server.ts`'s two resume legs)
-     *  would still need it, and a per-writer arm is exactly the shape that drifts. */
+     *  would still need it, and a per-writer arm is exactly the shape that drifts.
+     *  Never rejects: the park is already committed by the engine (its card is in the checkpoint store) and only the run row's park write
+     *  decides the run (`park-row-commit.ts`); an unwritable park / usage row is a loud log gap (`appendParkRow`), not a verdict. */
     appendParked(kind: ParkLedgerEventType, result: unknown): Promise<void>;
     /** Terminal `done` event. `result` must already be checkpoint-token-stripped (and, on the bg leg,
      *  model-usage-attached) by the caller. */

package/dist/trace/project.d.ts

@@ -217,7 +217,7 @@ export declare function toolStartEventData(ev: {
  * `done` 永远到不了、重连恒复现同一处),而 `gate-outcome-defective` 那一格还不涨。
  *
  * ⇒ 兑现方式从「枚举」换成**结构**:任何逃出投影的异常同走既有的那一口 report + withhold。规则因此变少
- * (不是「守住已知的 N 种坏形」而是「坏字节一律 withhold」)。core 7.51.0 起筛本身对任意 JSON 形不抛(KL-1731-a:只覆盖 JSON ——
+ * (不是「守住已知的 N 种坏形」而是「坏字节一律 withhold」)。core 7.51.0 起筛本身对任意 JSON 形不抛([ref]:只覆盖 JSON ——
  * 访问器 / Proxy 这类非 JSON 值仍可能抛),本仓此前叠在筛前的具名形门与成员门(第二读法)随之退役,诊断串就是筛给的缺陷句。
  * ⛔ **刻意不动**「先脱敏后截断」的次序:截断在前会把跨界的密钥切成半截明文留在输出里,而且它只治
  * `note` 一条叶(`approver` 同病)—— 那是给一个类打两个特判,正是本仓要消掉的形。
@@ -294,7 +294,8 @@ export declare function reasoningEndEventData(ev: Record<string, unknown>): Segm
  *  can never appear here) — SAME UNTRUSTED RAW contract as `output` (a card carries `originalFile`/stdout bodies),
  *  so it gets the same deep redaction before it is persisted or echoed — except a media card's `file.base64` (image / document
  *  cards: the second encoding of the same bytes the `output` block carries), which, like the block's `data`, is an encoding of
- *  bytes and not text ({@link projectToolStructured}; the durable face drops it in the ledger confluence). `label`(core 展示名,同 tool_start 的
+ *  bytes and not text; a card that carries a record with a disposition table (an MCP authorization failure card's `authorization`) has that member
+ *  projected by the record's table ({@link projectToolCard}, the one reader of a tool card — session history reads `toolResult.details` with it too; the durable face drops the media bytes in the ledger confluence). `label`(core 展示名,同 tool_start 的
  *  label 待遇 verbatim)白名单排查(2026-07-24)补齐进函数本体——此前外包给调用点各自手动拼接,7 处只有
  *  3 处记得拼,resume leg + ledger-sink 落盘两处漏了,持久化记录本身缺 label 一写盘就永久追不回来。 */
 export declare function toolEndEventData(ev: {
@@ -333,7 +334,7 @@ export declare function toolEndEventData(ev: {
  *  · `toolCallId` / `toolName` —— 调用 id(🔴 [ref] 订正:出身是**服务商**在 tool_use / tool_calls 里给的,引擎缺席时自铸兜底、越界时折叠 ——
  *    此前写「引擎铸」不实)与名册里的工具名(与 `tool_start` 逐字同源)⇒ verbatim。调用 id 这一族的形状在**全部面的共同入口**一次施加 ——
  *    core 7.36.0([ref])brain 建调用那一行的准入(在形原样 / 越界单射折叠,原字节只在转录 `ToolCall.wireId`),一方 brain 新铸的调用在逐帧面上
- *    恒是在形的引擎 id(残余两条 [ref]:≤7.106.0 写下的存量行 resume 出来的帧是服务商原串逐字;宿主 Brain 不准入 KL-1207-a —— 详见
+ *    恒是在形的引擎 id(残余两条 [ref]:≤7.106.0 写下的存量行 resume 出来的帧是服务商原串逐字;宿主 Brain 不准入 [ref] —— 详见
  *    run-terminal `admitProviderEcho` 顶注);
  *    本仓不设第二道闸(见 run-terminal `admitProviderEcho` 顶注;[ref] 关)。
  *  · `elapsedTimeSeconds` —— 引擎铸的整秒,单调、一 call 一个原点 ⇒ 有限数才铸键。
@@ -440,8 +441,10 @@ export interface ModelUsageSeat {
  * 终局由 {@link attachModelUsage} 先结清最后一拍再落 `done`,停驻由本函数先 drain 再落停驻行。顺序属于写口、不属于调用点:
  * 只回结果的 verify 腿没有逐 turn 落账的流(无 `turn_end` 帧),挂起前的用量只有停驻这一拍才落账;若各调用点各自记得「先结清」,
  * 这条腿的账本尾帧就会是 `model_usage`,与不带 `verify` 的停驻(用量在 `turn_end` 就结清了)两形不同序(`GET /v1/runs/:id/events` 的尾帧)。
- * 用量行落不下 ⇒ 停驻行**照落**,然后把用量行的失败抛给调用方(失败语义与此前逐字同:账本里有停驻帧、调用方按「停驻没落定」收场 —— bg 腿以 `failed` 收、手里的卡作废;
- * 尽力而为的调用点(detach 腿的兜底停驻、续跑腿的重开臂)照旧吞掉它,停驻帧不因为一笔用量行的失败而缺席)。顺序变了,谁来写、写不下谁抛没有变。
+ *
+ * **不抛**:这两行是一次**已提交**停驻的投影(卡在引擎交回之前已落 checkpoint 店;停驻成立与否只由 run 行的停驻写回答,`park-row-commit.ts`)。
+ * 写不下 ⇒ 响亮留痕(`server.runs.terminal-ledger-write-failed`,`arm=park-usage` / `arm=park-row`,与终局帧写不下同一只 tag:run 行是 durable truth,
+ * 读面与收割器容忍账本尾巴缺席),调用方照常往下提交行 —— 账本写不下从不改这条 run 的判词。用量行落不下 ⇒ 停驻行照落(两笔各自留痕)。
  */
 export declare function appendParkRow(append: AppendFn, usage: ModelUsageSeat | undefined, word: ParkLedgerEventType, result: unknown, reopened?: string | null): Promise<void>;
 /**