@sema-agent/server 7.151.0 → 7.152.0

package/dist/http/route-table.js

@@ -122,6 +122,7 @@ const SHAPED_LABEL_DECLS = ROUTE_DECLARATIONS.filter((d) => !("path" in d) && ty
 const BILLABLE_DECLS = ROUTE_DECLARATIONS.filter((d) => d.billable !== undefined);
 const METHOD_DISPATCHED_DECLS = ROUTE_DECLARATIONS.filter((d) => d.methodDispatched === true);
 const SUBSCRIPTION_DECLS = ROUTE_DECLARATIONS.filter(isDispatchDecl).filter((d) => d.subscription === true);
+const POWER_DECLS = ROUTE_DECLARATIONS.filter(isDispatchDecl).filter((d) => d.power !== undefined);
 const CREDENTIAL_GATED_BY_METHOD = (() => {
     const m = new Map();
     for (const d of ROUTE_DECLARATIONS)
@@ -156,6 +157,9 @@ export function isCredentialGatedRewrite(method, url) {
 export function isSubscriptionRequest(method, url) {
     return SUBSCRIPTION_DECLS.some((d) => d.methods.includes(method) && matchDecl(d, url) !== null);
 }
+export function declaredPowerOf(method, url) {
+    return POWER_DECLS.find((d) => d.methods.includes(method) && matchDecl(d, url) !== null)?.power;
+}
 export function isMethodDispatchedSubmitPath(url) {
     return METHOD_DISPATCHED_DECLS.some((d) => declMatches(d, url));
 }

package/dist/http/routes/admin-config-refresh.js

@@ -13,11 +13,11 @@ export async function handleAdminConfigRefresh(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            if (!facts.operatorLane(deps).available) {
-                sendOperatorPrincipalsRequired(res);
+            if (!facts.operatorLane(deps, "operate").available) {
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             }
-            if (!explicitOperatorOk(principal, deps.config)) {
+            if (!explicitOperatorOk(principal, deps.config, "operate")) {
                 sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
                 return;
             }

package/dist/http/routes/admin-drain.d.ts

@@ -6,6 +6,8 @@
  * 进入排空经 `drainState.enter`(收尾链装的唯一入口)。
  *  · 门序 = operator 面的既有口径(`routes/retention-ops.ts` 逐字):身份 → 授权 → 验型;billable=false,**刻意不吃排空 503**
  *    (排空中的重放必须能拿到 `already_draining` 回执,吃了就自锁)。
+ *  · 授权 = 持 `drain` 权力(声明行的 `power` 列,本口的门与分派层的圈禁判读同一格):全运维档(`OPERATOR_PRINCIPALS`,持每一只权力)∪ 排空档
+ *    (`OPERATOR_DRAIN_PRINCIPALS`,服务主体只持这一只 —— 它的身份只在本口算数,别的口 403 `auth.principal_confined`,见 `operator-roster.ts`)。
  *  · 判序:体坏(含动作号不是标识符形 —— settings-schema 11 `DRAIN_ACTION_ID`)⇒ 400 `request.field_invalid`(零状态变化)→ 没有收尾链(嵌入宿主 / 测试夹具)⇒ 501 `capability.drain_state_required`
  *    → 身份不符 ⇒ 409 `conflict.fleet_identity`(零状态变化;拒句点名不符的字段,不回显值)→ 入口:已在排空 / 硬停已在进行 ⇒ 200 回执
  *    (这一发的期限不会被采用);这一发会进入排空而 `deadlineAt` 离进入那一拍超过 `FLEET_LEASE_OUTAGE_MAX_MS`(`config.fleetLeaseOutageMaxMs`,
@@ -24,6 +26,7 @@ export declare const ADMIN_DRAIN_ROUTES: readonly [{
     readonly id: "admin-drain";
     readonly path: "/v1/admin/drain";
     readonly methods: readonly ["POST"];
+    readonly power: "drain";
 }];
 type AdminDrainRouteId = RouteIdsOf<typeof ADMIN_DRAIN_ROUTES>;
 export {};

package/dist/http/routes/admin-drain.js

@@ -7,7 +7,7 @@ import { drainIdentityMismatches } from "../../fleet/drain-entry.js";
 import { assertNever } from "../route-ctx.js";
 import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 export const ADMIN_DRAIN_PATH = "/v1/admin/drain";
-const OPERATOR_ONLY_MESSAGE = "drain declaration is operator-only: the caller principal is not in OPERATOR_PRINCIPALS";
+const OPERATOR_ONLY_MESSAGE = "drain declaration is for this deployment's operators and drain principals only: the caller principal is in neither OPERATOR_PRINCIPALS nor OPERATOR_DRAIN_PRINCIPALS";
 export async function handleAdminDrain(req, res, match, ctx) {
     const { deps } = ctx;
     switch (match.decl.id) {
@@ -17,11 +17,12 @@ export async function handleAdminDrain(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            if (!facts.operatorLane(deps).available) {
-                sendOperatorPrincipalsRequired(res);
+            const power = ADMIN_DRAIN_DECL.power;
+            if (!facts.operatorLane(deps, power).available) {
+                sendOperatorPrincipalsRequired(res, power);
                 return;
             }
-            if (!explicitOperatorOk(principal, deps.config)) {
+            if (!explicitOperatorOk(principal, deps.config, power)) {
                 sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
                 return;
             }
@@ -59,7 +60,6 @@ export async function handleAdminDrain(req, res, match, ctx) {
             return assertNever(match.decl.id);
     }
 }
-export const ADMIN_DRAIN_ROUTES = [
-    { id: "admin-drain", path: ADMIN_DRAIN_PATH, methods: ["POST"] },
-];
+const ADMIN_DRAIN_DECL = { id: "admin-drain", path: ADMIN_DRAIN_PATH, methods: ["POST"], power: "drain" };
+export const ADMIN_DRAIN_ROUTES = [ADMIN_DRAIN_DECL];
 //# sourceMappingURL=admin-drain.js.map

package/dist/http/routes/admin-memory-optout.js

@@ -19,10 +19,10 @@ export async function handleMemoryOptOut(req, res, match, ctx) {
     }
     const fact = facts.memoryOptOutGrant(deps);
     if (!fact.available && fact.why === "operator_principals_empty") {
-        sendOperatorPrincipalsRequired(res);
+        sendOperatorPrincipalsRequired(res, "operate");
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config)) {
+    if (!explicitOperatorOk(principal, deps.config, "operate")) {
         sendError(res, 403, "auth.operator_only", "memory opt-out grant administration is operator-only: the caller principal is not in OPERATOR_PRINCIPALS");
         return;
     }
@@ -33,7 +33,7 @@ export async function handleMemoryOptOut(req, res, match, ctx) {
                 sendError(res, 501, "capability.memory_optout_grant_required", "this deployment has no memory opt-out grant table: the per-principal memory-capture opt-out authorization store lives on a SQL store backend (DB_BACKEND=mysql|pg) and the local backend deliberately keeps no companion store for forgetting — wire a SQL backend to administer opt-out grants");
                 return;
             case "operator_principals_empty":
-                sendOperatorPrincipalsRequired(res);
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             default:
                 return assertNever(fact.why);

package/dist/http/routes/adoption.js

@@ -69,10 +69,10 @@ async function operatorLane(req, res, id, params, ctx) {
     }
     const fact = facts.adoption(deps);
     if (!fact.available && fact.why === "operator_principals_empty") {
-        sendOperatorPrincipalsRequired(res);
+        sendOperatorPrincipalsRequired(res, "operate");
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config)) {
+    if (!explicitOperatorOk(principal, deps.config, "operate")) {
         sendError(res, 403, "auth.operator_only", "adoption is an operator-only deployment action");
         return;
     }
@@ -82,7 +82,7 @@ async function operatorLane(req, res, id, params, ctx) {
                 sendAdoptionStoreRequired(res);
                 return;
             case "operator_principals_empty":
-                sendOperatorPrincipalsRequired(res);
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             default:
                 return assertNever(fact.why);
@@ -129,8 +129,6 @@ async function operatorLane(req, res, id, params, ctx) {
                 return;
             }
             const out = await runner.start(fromPrincipal, toPrincipal);
-            if (out.kind === "receipt")
-                await deps.toolApproval?.followRowOwners();
             sendOutcome(res, out);
             return;
         }

package/dist/http/routes/approvals-assistant.d.ts

@@ -118,6 +118,7 @@ export type PendingRowForWire = PendingRow & {
     governanceForced?: true;
     rememberRefused?: true;
     agent?: SessionAgent;
+    askId?: string;
 };
 /**
  * 🔴 [ref]-2 / [ref]②:两条 durable 读面(`GET /v1/approvals` + `/v1/approvals/stream`)的**唯一**
@@ -153,7 +154,7 @@ export declare function streamApprovals(req: IncomingMessage, res: ServerRespons
  * 缺席,流的字节与 [ref] 之前逐字相同(能力缺席 = 零变化,不是空数组)。**位置在 `pollMs` 之前**
  * 与 `governance` 同一条理由:`pollMs` 只有测试传,而本参数是每个生产调用点都必须表态的那一个。
  */
-live: Pick<ToolApprovalCoordinator, "listLivePending"> | undefined, 
+live: Pick<ToolApprovalCoordinator, "listLivePending" | "readParkedAskOfGate"> | undefined, 
 /**
  * 🔴 [ref]:`pending` 车道的**第二个半场** —— 被扣的跨会话来信(`peer_inbound` 行),与 `GET /v1/approvals` 的 `pending[]`
  * **同一只**闭包({@link peerInboundRowsFor},已绑调用方自己的信箱 scope)。与停驻行同一条 delta 车道、同一对事件名

package/dist/http/routes/approvals-assistant.js

@@ -3,9 +3,9 @@ import { skillCardFacts } from "../../approval-card.js";
 import { hostDecisionFacts, readDecider, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
 import { findParkedAgentForCheckpoint } from "../../parked-decide.js";
-import { DECIDED_REPLAY_SCAN_CAP, pendingTriageOrder } from "../../plugins/checkpoint-store-face.js";
+import { DECIDED_REPLAY_SCAN_CAP, displayRuleOffers, pendingTriageOrder } from "../../plugins/checkpoint-store-face.js";
 import { approvalPayloadFingerprint } from "../../plugins/approval-payload-fingerprint.js";
-import { carriesDeploymentListQuestion, standingAnswerDurablyRecordable } from "../../tool-approval.js";
+import { cardRuleOffersOfAskRow, carriesDeploymentListQuestion, readPersistRuleSlot, standingAnswerDurablyRecordable } from "../../tool-approval.js";
 import { APPROVAL_GATE_KINDS } from "../../approval-content-kind.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, scopeCellOf, CHECKPOINT_PUBLIC_SCOPE, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
@@ -13,7 +13,7 @@ import { keyAdmits } from "../../owner-faces.js";
 import { personOf } from "../../owner-brands.js";
 import { editedPlanBinding, verifyDirectDoorProof } from "../../principal-jwt.js";
 import { isWellFormedUnicode } from "../../principal-shape.js";
-import { MAX_APPROVAL_REASON_CHARS, projectQuestionAnswer, questionAnswerFromProjection } from "../../approval-hmac.js";
+import { MAX_APPROVAL_REASON_CHARS, persistRuleFromProjection, projectPersistRule, projectQuestionAnswer, questionAnswerFromProjection } from "../../approval-hmac.js";
 import { PLAN_APPROVE_PERMISSION_MODES_AFTER, isPlanApprovePermissionModeAfter, planReviewDecisionExitsPlan, storedBodyPermissionMode } from "../../task-settings.js";
 import { MAX_APPROVAL_NONCE_CHARS } from "../../plugins/approval-nonce-store.js";
 import { redactedPreview, redactSecrets } from "../../trace/redact.js";
@@ -22,12 +22,13 @@ import { buildRunName } from "../../fleet/fleet-bus.js";
 import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, logRequestError, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
-import { gatedSubject, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { createLogger } from "../../observability/logger.js";
+import { gatedSubject, explicitOperatorOk, confinedTierOf, sendPrincipalConfined, sendPrincipalRefusal } from "../principal-gate.js";
 import { admitRunById, admitSessionById, callerEntry, callerOf, callerOfDecision, deciderSubjectOf, enter, latestRunIdOf, listRunsOfScope, protocolEntry, readSessionAgent, readVisibleRun, refuse, runFactsOf, withCaller } from "../owner-access.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
 import { deploymentListAsks } from "../../approval.js";
 import { grantBindingOf } from "../../standing-answer-grant.js";
-import { sendResumeOutcome } from "../route-ctx.js";
+import { readRememberSlot, ruleReceiptOf, sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { storeFaultClassOf } from "../../plugins/store-fault.js";
@@ -42,10 +43,10 @@ import { defaultPeerInboundFace, parsePeerInboundId } from "../../peer-inbound-f
 import { engineScopeOfOwner } from "../../engine-identity.js";
 import { RESUME_RESTATABLE_KEYS, readResumeRestatement } from "../resume-restatement.js";
 const DECIDE_BODY_DECLARED_KEYS = [
-    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decidedVia", "decision", "feedback", "reason", "remember", "updatedInput",
+    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decidedVia", "decision", "feedback", "persistRule", "reason", "remember", "updatedInput",
     ...RESUME_RESTATABLE_KEYS,
 ];
-const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
+const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "persistRule", "reason"];
 const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "decidedVia", "feedback", "remember", "updatedInput", ...RESUME_RESTATABLE_KEYS];
 function readDecisionDoorRestatement(res, body, directDoorActive) {
     if (directDoorActive && RESUME_RESTATABLE_KEYS.some((key) => body[key] !== undefined)) {
@@ -68,6 +69,7 @@ const PROOF_SLOT_OF = {
     decision: "decision",
     editedPlan: "boundInputHash",
     permissionModeAfter: "permissionModeAfter",
+    persistRule: "persistRule",
     reason: "reason",
 };
 function buildApprovalEnvelope(sessionId, covered, reading) {
@@ -312,7 +314,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
         }
         const cs = park.checkpointStore;
         const principal = gatedSubject(req, deps.config);
-        const operator = explicitOperatorOk(principal === undefined ? undefined : personOf(principal), deps.config);
+        const operator = explicitOperatorOk(principal === undefined ? undefined : personOf(principal), deps.config, "operate");
         const ownScope = principal ?? CHECKPOINT_PUBLIC_SCOPE;
         if (match.decl.id === "approvals-stream") {
             const ownerParam = operator ? (new URLSearchParams(match.search).get("owner") ?? undefined) : undefined;
@@ -333,7 +335,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendApprovalsReadFailure(req, res, deps.logger, err);
                 return;
             }
-            const pending = [...(await projectDurableQueue(durableRows, deps.config, deps.sessionStorage)), ...peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam)()];
+            const pending = [...(await projectDurableQueue(durableRows, deps.config, deps.sessionStorage, deps.toolApproval)), ...peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam)()];
             const livePending = deps.toolApproval ? await deps.toolApproval.listLivePending(scope) : undefined;
             sendJson(res, 200, {
                 pending,
@@ -677,19 +679,16 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
                 const storeNowMs = await store.nowMs();
-                const hdr = (n) => { const h = req.headers[n]; return Array.isArray(h) ? h[0] : h; };
-                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, buildApprovalEnvelope(run.sessionId, PLAN_REVIEW_PROOF_COVERED_KEYS, {
+                const proof = admitDirectDoorDecider(req, res, buildApprovalEnvelope(run.sessionId, PLAN_REVIEW_PROOF_COVERED_KEYS, {
                     boundCallId: planNonce ?? null,
                     checkpointId: sighting?.value,
                     decision,
                     editedPlan: decision === "edit" ? editedPlanBinding(body.editedPlan) : null,
                     permissionModeAfter: isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined,
                     reason: typeof body.reason === "string" ? body.reason : null,
-                }), deps.config, { actionBinding: false, nowSec: Math.floor(storeNowMs / 1000) });
-                if (!proof.ok) {
-                    sendError(res, proof.status, proof.errorCode, proof.error);
+                }), deps.config, match.decl.power, { actionBinding: false, nowSec: Math.floor(storeNowMs / 1000) });
+                if (proof === undefined)
                     return;
-                }
                 deciderPrincipal = proof.principal;
                 singleUse = proof.singleUse === undefined ? undefined : { proof: proof.singleUse, store };
             }
@@ -740,7 +739,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const doorKind = approvalQueueKindOfDoorId(sessionId);
             switch (doorKind) {
                 case "peer_inbound":
-                    await decidePeerInbound(req, res, sessionId, { readJson, config: deps.config, logger: deps.logger, principal, face: defaultPeerInboundFace });
+                    await decidePeerInbound(req, res, sessionId, { readJson, config: deps.config, logger: deps.logger, principal, face: defaultPeerInboundFace, power: match.decl.power });
                     return;
                 case "checkpoint":
                     break;
@@ -772,15 +771,12 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 return;
             }
             let remember = false;
-            if (body.remember !== undefined) {
-                if (body.remember !== "session") {
-                    sendError(res, 400, "request.field_invalid", `remember must be "session"`);
-                    return;
-                }
-                if (decision !== "approve") {
-                    sendError(res, 400, "request.field_conflict", "remember requires decision 'approve'", fieldConflictFacts("remember_decision", ["remember", "decision"]));
-                    return;
-                }
+            const rememberSlot = readRememberSlot(body.remember, decision);
+            if (rememberSlot.kind === "refused") {
+                sendError(res, 400, rememberSlot.refusal.errorCode, rememberSlot.refusal.message, rememberSlot.refusal.facts);
+                return;
+            }
+            if (rememberSlot.kind === "session") {
                 if (deps.config.directDoorActive) {
                     sendError(res, 400, "remember_not_in_proof", "remember is not supported on a direct-door worker (not covered by the decision proof)");
                     return;
@@ -791,6 +787,12 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
                 remember = true;
             }
+            const ruleSlot = readPersistRuleSlot(body.persistRule, decision === "approve" ? "allow" : "deny");
+            if (!ruleSlot.ok) {
+                sendError(res, 400, "request.body_shape", ruleSlot.error);
+                return;
+            }
+            const ruleProjection = ruleSlot.slot !== undefined ? projectPersistRule(ruleSlot.slot) : undefined;
             let answer;
             let answerProjection;
             if (body.answer !== undefined) {
@@ -864,24 +866,19 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             };
             let deciderPrincipal = principal === undefined ? undefined : personOf(principal);
             if (deps.config.directDoorActive) {
-                const hdr = (n) => {
-                    const h = req.headers[n];
-                    return Array.isArray(h) ? h[0] : h;
-                };
-                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, buildApprovalEnvelope(sessionId, DECIDE_PROOF_COVERED_KEYS, {
+                const proof = admitDirectDoorDecider(req, res, buildApprovalEnvelope(sessionId, DECIDE_PROOF_COVERED_KEYS, {
                     answer: answerProjection,
                     boundCallId: binding.boundCallId,
                     boundInputHash: binding.boundInputHash,
                     decision,
+                    persistRule: ruleProjection,
                     reason: typeof body.reason === "string" ? body.reason : null,
-                }), deps.config);
-                if (!proof.ok) {
-                    sendError(res, proof.status, proof.errorCode, proof.error);
+                }), deps.config, match.decl.power);
+                if (proof === undefined)
                     return;
-                }
                 deciderPrincipal = proof.principal;
             }
-            const deciderCaller = { subject: deciderSubjectOf(principal, deciderPrincipal), operator: explicitOperatorOk(deciderPrincipal, deps.config) };
+            const deciderCaller = { subject: deciderSubjectOf(principal, deciderPrincipal), operator: explicitOperatorOk(deciderPrincipal, deps.config, "operate") };
             if (!deciderCaller.operator) {
                 const cpScope = await cs
                     .peekPendingScope(sessionId, { gateKinds: APPROVAL_GATE_KINDS })
@@ -891,7 +888,8 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
             }
-            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(decider, deciderPrincipal), req, answer, binding, remember ? { grantedBy: deciderPrincipal ?? null, laneCannotRecord: "refuse" } : undefined, true, deciderCaller, restated.restatement);
+            const persistRule = ruleProjection !== undefined ? { slot: persistRuleFromProjection(ruleProjection), inputWasEdited: binding.updatedInput !== undefined } : undefined;
+            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(decider, deciderPrincipal), req, answer, binding, remember ? { grantedBy: deciderPrincipal ?? null, laneCannotRecord: "refuse" } : undefined, true, deciderCaller, restated.restatement, persistRule);
             const replay = await decideIdempotentReplay(cs, {
                 sessionId,
                 out,
@@ -910,12 +908,31 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendResumeOutcome(res, replay, deps.logger);
                 return;
             }
-            sendResumeOutcome(res, out, deps.logger, remember ? { rememberApplied: out.rememberApplied === true } : undefined);
+            const rule = out.status >= 200 && out.status < 300 ? ruleReceiptOf(out, persistRule) : undefined;
+            const extra = { ...(remember ? { rememberApplied: out.rememberApplied === true } : {}), ...(rule ?? {}) };
+            sendResumeOutcome(res, out, deps.logger, Object.keys(extra).length > 0 ? extra : undefined);
             return;
         }
     }
     return assertNever(match.decl.id);
 }
+function admitDirectDoorDecider(req, res, envelope, config, power, opts) {
+    const hdr = (n) => {
+        const h = req.headers[n];
+        return Array.isArray(h) ? h[0] : h;
+    };
+    const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, envelope, config, opts);
+    if (!proof.ok) {
+        sendError(res, proof.status, proof.errorCode, proof.error);
+        return undefined;
+    }
+    const confined = confinedTierOf(proof.principal, config, power);
+    if (confined !== undefined) {
+        sendPrincipalConfined(res, confined);
+        return undefined;
+    }
+    return proof;
+}
 async function decidePeerInbound(req, res, id, env) {
     const body = (await env.readJson(req));
     const decision = body?.decision === "approve" ? "approve" : body?.decision === "deny" ? "deny" : undefined;
@@ -938,15 +955,9 @@ async function decidePeerInbound(req, res, id, env) {
     }
     let decider = env.principal;
     if (env.config.directDoorActive) {
-        const hdr = (n) => {
-            const h = req.headers[n];
-            return Array.isArray(h) ? h[0] : h;
-        };
-        const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, buildApprovalEnvelope(id, DECIDE_PROOF_COVERED_KEYS, { answer: undefined, boundCallId: undefined, boundInputHash: undefined, decision, reason: null }), env.config);
-        if (!proof.ok) {
-            sendError(res, proof.status, proof.errorCode, proof.error);
+        const proof = admitDirectDoorDecider(req, res, buildApprovalEnvelope(id, DECIDE_PROOF_COVERED_KEYS, { answer: undefined, boundCallId: undefined, boundInputHash: undefined, decision, persistRule: undefined, reason: null }), env.config, env.power);
+        if (proof === undefined)
             return;
-        }
         decider = proof.principal;
     }
     const coord = parsePeerInboundId(id);
@@ -1035,9 +1046,45 @@ function projectPendingForWire(row, deployment, agent) {
     });
     return { kind: "checkpoint", ...redacted, ...(governanceForced ? { governanceForced } : {}), ...(rememberRefused ? { rememberRefused: true } : {}), ...(agent !== undefined ? { agent } : {}) };
 }
-async function projectDurableQueue(rows, deployment, sessions) {
+async function projectDurableQueue(rows, deployment, sessions, cards) {
     const agents = await sessionAgentsOf(rows.map((r) => r.sessionId), sessions);
-    return rows.map((r) => projectPendingForWire(r, deployment, agents.get(r.sessionId)));
+    const carded = await Promise.all(rows.map((r) => withCardRecord(r, cards)));
+    return carded.map((r) => projectPendingForWire(r, deployment, agents.get(r.sessionId)));
+}
+const queueLogger = createLogger();
+async function withCardRecord(row, cards) {
+    if (cards === undefined || row.toolCallId === null || row.boundInputHash === undefined)
+        return row;
+    const asked = await cards.readParkedAskOfGate(row.sessionId, { boundCallId: row.toolCallId, boundInputHash: row.boundInputHash });
+    const withOffers = (ruleOffers) => {
+        const next = { ...row };
+        if (ruleOffers === undefined)
+            delete next.ruleOffers;
+        else
+            next.ruleOffers = ruleOffers;
+        return next;
+    };
+    const withAskIdentity = (next, ask) => {
+        if (next.taskId !== null && next.taskId !== ask.taskId) {
+            queueLogger.warn("approval queue row: the parked leg's task differs from the ask's task — the row keeps its checkpoint identity", { sessionId: row.sessionId, askId: ask.askId });
+            return next;
+        }
+        return { ...next, taskId: ask.taskId, askId: ask.askId };
+    };
+    switch (asked.kind) {
+        case "none":
+            return row;
+        case "unreadable":
+            return withOffers(undefined);
+        case "row": {
+            const offers = cardRuleOffersOfAskRow(asked.row);
+            return withAskIdentity(withOffers(offers === undefined ? undefined : displayRuleOffers(offers, { countRedactions: false })), asked.row);
+        }
+        default: {
+            const unhandled = asked;
+            throw new Error(`queue projection: unhandled parked-ask reading ${JSON.stringify(unhandled)}`);
+        }
+    }
 }
 async function sessionAgentsOf(sessionIds, sessions) {
     const out = new Map();
@@ -1122,7 +1169,7 @@ export async function streamApprovals(req, res, cs, live, peerInbound, sessions,
     while (!closed) {
         let snapshot;
         try {
-            const pending = [...(await projectDurableQueue(await cs.listPending(scope), governance, sessions)), ...(peerInbound?.() ?? [])];
+            const pending = [...(await projectDurableQueue(await cs.listPending(scope), governance, sessions, live)), ...(peerInbound?.() ?? [])];
             snapshot = { pending, livePending: live ? await live.listLivePending(scope) : [] };
         }
         catch (err) {

package/dist/http/routes/capabilities.d.ts

@@ -38,6 +38,10 @@ export declare const CAPABILITIES_ROUTES: readonly [{
     readonly id: "capability-mcp";
     readonly path: "/v1/capabilities/mcp";
     readonly methods: readonly ["GET"];
+}, {
+    readonly id: "capability-scenario-effective";
+    readonly path: "/v1/capabilities/scenario";
+    readonly methods: readonly ["GET"];
 }, {
     readonly id: "capability-mcp-probe";
     readonly path: "/v1/capabilities/mcp/probe";

package/dist/http/routes/capabilities.js

@@ -36,7 +36,8 @@ import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import * as facts from "../../capability-facts.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
 import { coercePermissionModeStrict, PERMISSION_MODE_WORDS, taskHooksHonored } from "../../task-settings.js";
-import { gatedPerson, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPerson, gatedSubject, sendPrincipalRefusal } from "../principal-gate.js";
+import { scenarioRequestedBySubject } from "../../request-form.js";
 import { readAdoptionImportCapability } from "../../adoption/import.js";
 import { headReadPresent } from "../../session-incarnation.js";
 import { callerTrust } from "../caller-trust.js";
@@ -57,6 +58,12 @@ function retentionAdvertisement(config) {
 export function createCapabilitiesLocal() {
     return { mcpProbe: createMcpProbeLocal() };
 }
+const QUERY_SCENARIO_REPEATED = Symbol("scenario query given more than once");
+const SCENARIO_QUERY_REPEATED_REFUSAL = "scenario must be given at most once (omit it to read this deployment's default scenario)";
+function scenarioQueryOf(search) {
+    const given = new URLSearchParams(search).getAll("scenario");
+    return given.length > 1 ? QUERY_SCENARIO_REPEATED : given[0];
+}
 export async function handleCapabilities(req, res, match, ctx) {
     const { deps } = ctx;
     switch (match.decl.id) {
@@ -140,6 +147,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 permissionRulesRevoke: facts.ruleLane(deps).available,
                 respondFreeFormRules: true,
                 respondBatchRuleOffers: true,
+                approvalDecideRuleSlot: true,
                 oneShot: true,
                 policy: true,
                 usage: Boolean(deps.costQuota),
@@ -213,6 +221,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 retention: retentionAdvertisement(deps.config),
                 peerLane: Boolean(deps.peerDirectory),
                 scenarioSubject: true,
+                effectiveScenario: true,
                 sessionList: facts.sessionList(deps).available,
                 sessionSearch: facts.sessionList(deps).available,
                 sessionKinds: facts.sessionKinds(deps).available ? [...SESSION_KINDS] : [],
@@ -263,15 +272,30 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            const scenarioParams = new URLSearchParams(match.search).getAll("scenario");
-            if (scenarioParams.length > 1) {
-                sendError(res, 400, "request.field_invalid", "scenario must be given at most once (omit it to read this deployment's default scenario)");
+            const named = scenarioQueryOf(match.search);
+            if (named === QUERY_SCENARIO_REPEATED) {
+                sendError(res, 400, "request.field_invalid", SCENARIO_QUERY_REPEATED_REFUSAL);
                 return;
             }
-            const scenarioName = await deps.scenarioGate(principal, scenarioParams[0]);
+            const { scenario: scenarioName } = await deps.scenarioGate(principal, scenarioRequestedBySubject(gatedSubject(req, deps.config), named));
             await serveMcpProbeFace(res, ctx, principal, { declaredBy: "deployment", specs: mcpForScenario(deps.config.mcpServers, scenarioName) ?? [] });
             return;
         }
+        case "capability-scenario-effective": {
+            const principal = gatedPerson(req, deps.config);
+            if (deps.config.requirePrincipal && !principal) {
+                sendPrincipalRefusal(res, req, deps.config);
+                return;
+            }
+            const named = scenarioQueryOf(match.search);
+            if (named === QUERY_SCENARIO_REPEATED) {
+                sendError(res, 400, "request.field_invalid", SCENARIO_QUERY_REPEATED_REFUSAL);
+                return;
+            }
+            const choice = await deps.scenarioGate(principal, scenarioRequestedBySubject(gatedSubject(req, deps.config), named));
+            sendJson(res, 200, { scenario: choice.scenario, source: choice.source });
+            return;
+        }
         case "capability-mcp-probe": {
             const principal = gatedPerson(req, deps.config);
             if (deps.config.requirePrincipal && !principal) {
@@ -401,6 +425,7 @@ export const CAPABILITIES_ROUTES = [
     { id: "capabilities", path: "/v1/capabilities", methods: ["GET"] },
     { id: "capability-scenario", pattern: /^\/v1\/capabilities\/scenarios\/(?<name>.*)$/, label: "/v1/capabilities/scenarios/:name", methods: ["GET"] },
     { id: "capability-mcp", path: "/v1/capabilities/mcp", methods: ["GET"] },
+    { id: "capability-scenario-effective", path: "/v1/capabilities/scenario", methods: ["GET"] },
     { id: "capability-mcp-probe", path: "/v1/capabilities/mcp/probe", methods: ["POST"] },
 ];
 //# sourceMappingURL=capabilities.js.map

package/dist/http/routes/config-catalog.js

@@ -23,13 +23,13 @@ export async function handleConfigCatalog(req, res, match, ctx) {
                         sendError(res, 501, "feature.config_catalog_disabled", "the config catalog is switched off on this deployment (CONFIG_CATALOG_ENABLED=false)");
                         return;
                     case "operator_principals_empty":
-                        sendOperatorPrincipalsRequired(res);
+                        sendOperatorPrincipalsRequired(res, "operate");
                         return;
                     default:
                         return assertNever(fact.why);
                 }
             }
-            if (!explicitOperatorOk(principal, deps.config)) {
+            if (!explicitOperatorOk(principal, deps.config, "operate")) {
                 sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
                 return;
             }

package/dist/http/routes/devices.js

@@ -144,7 +144,7 @@ export async function handleDevices(req, res, match, ctx) {
         }
     }
     const { store, hub, enrollment, runStore } = lane;
-    const operator = explicitOperatorOk(principal, deps.config);
+    const operator = explicitOperatorOk(principal, deps.config, "operate");
     const domain = deviceOwnerDomainOf(req, deps.config);
     if (match.decl.id === "devices-list") {
         if (!operator && domain === undefined) {

package/dist/http/routes/diagnostics.d.ts

@@ -42,7 +42,6 @@ export interface ServerWiringGates {
  *  不再是装配现场的事实,而是别处算完可能已漂的复述)。 */
 export interface ServerWiringGateInput {
     toolApprovalEnabled: boolean;
-    streamApprovalEnabled: boolean;
     /** 谓词自己的入参类型(结构形,不 import store 依赖树)—— 取型而非重述,两处不可能漂。 */
     backend: StreamApprovalGateInput["backend"];
     /** 谓词自己的入参类型(只收店的形,工厂方法过不了 tsc)—— 取型而非重述,与 `backend` 同理;在场性即事实,本面不读实例的内容。 */
@@ -116,8 +115,9 @@ export declare function assertStaticWiringConsistent(facts: StaticWiringFacts, l
  * 字符串,端口误暴露到公网就是侦察面(装配拓扑 / 治理姿态 / 写保护名表)。配了 service 凭据的部署上,到得了这里的请求都过了全局凭据门、
  * 必然带着验过的身份,本判不咬;不要求静态凭据在场(鉴权桥的登录令牌就是身份)。
  *
- * 判源 = TCP 对端地址(`req.socket.remoteAddress`),**非任何头**(XFF 类头在无反代形上是自造面;有反代的部署必然配凭据)。
- * `remoteAddress` 缺席(socket 已断等边缘)⇒ 判拒(fail-closed)。
+ * 「本机」按请求通道穷举(`request-channel.ts`;加一种通道不接 ⇒ 编译红):经本机控制 socket 来的请求 = 本机(能连上它的只有引擎的 OS 用户 —— 与 `/health` 把它认作
+ * 本机用户同读,同一只请求不被一面认作本机、另一面认作远程);经 TCP 来的请求判源 = TCP 对端地址(`req.socket.remoteAddress`),**非任何头**(XFF 类头在无反代形上是自造面;
+ * 有反代的部署必然配凭据)。`remoteAddress` 缺席(socket 已断等边缘)⇒ 判拒(fail-closed)。
  */
 export declare function remoteWithoutVerifiedIdentity(req: IncomingMessage, config: Parameters<typeof verifiedIdentitySource>[1]): boolean;
 export declare function handleDiagnostics(req: IncomingMessage, res: ServerResponse, match: RouteMatch<DiagnosticsRouteId>, ctx: RouteCtx): Promise<void>;