@sema-agent/server 7.151.0 → 7.152.0

package/dist/boot/web-admin.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { readFile as fsReadFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { WEB_ADMIN_ENV, formatConfigPath } from "@sema-agent/settings-schema";
+import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 import { stableStringify } from "@sema-agent/settings-schema/hash";
 import { buildModelRefusalsSignal } from "../model-entry-refusal.js";
 import { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "@sema-agent/core";
@@ -523,12 +523,7 @@ export async function createWebAdminRuntime(ctx) {
             }
             if (read.migrated !== undefined) {
                 const m = read.migrated;
-                logger.info("config_lkg_migrated", {
-                    to: lkgPath,
-                    fromFormat: m.fromFormat,
-                    ...(m.note !== undefined ? { note: m.note } : {}),
-                    receipts: m.receipts.map((r) => ({ migration: r.migration, document: r.document, path: formatConfigPath(r.path), appliedAs: r.appliedAs })),
-                });
+                logger.info("config_lkg_migrated", { to: lkgPath, fromFormat: m.fromFormat, note: m.note });
                 try {
                     await saveLkg(lkgPath, cc?.worker, identity, read.lkg.effective, read.lkg.etag);
                 }

package/dist/capabilities/approvals-push.d.ts

@@ -22,9 +22,9 @@
  *
  * 🔴 **刻意不合并进 `approvals` 或 `toolApproval`**:
  *  · `approvals` 答的是「这条车道在不在」(它为真而本位为假的部署是**常态**:没开工具审批的那些);
- *  · `toolApproval` 答的是「活体工具审批 HITL 在不在」,与「那条 SSE 推不推 live 行」不是一回事 ——
- *    没有 checkpoint 底座的部署上它可以为真而**根本没有这条流**。
- * 任一位单读都会对一半部署说谎,所以本位是它们的合取、而不是其中之一的别名。
+ *  · `toolApproval` 答的是「活体工具审批 HITL 在不在」。协调器只在呈卡协议上场(含 park 设施 = checkpoint 底座)时构造,
+ *    所以生产装配上 `toolApproval` 为真蕴含 ①,本位与 `toolApproval` 同值;本位仍逐项对着腿的判据写合取(不读另一位的投影)。
+ *    三位(`toolApproval` / `streamApproval` / 本位)如今说的是同一件事 —— 合并成一位是另一件 wire 变更,不在这里做。
  *
  * ⚠️ **位为真只保证这条源在场**,不保证这一次有任何悬挂 ask、也不保证跨副本可见:live 半场是**进程内
  * 投影**(与 `GET /v1/approvals` 的 `livePending` 逐字同限,非本件引入),durable park 行那一半才是

package/dist/capabilities/scenarios.d.ts

@@ -347,12 +347,26 @@ export interface ScenarioRuling {
  */
 export type ScenarioRulingRead = ScenarioRuling | "unavailable" | undefined;
 /**
- * 一个场景名的**来源**(闭集:新增一词 ⇒ {@link danglingScenarioRefusal} 的穷尽 switch 编译红)。
- *  · `ruling` —— 中心按主体指派的场景(`ScenarioRuling.scenario`);
- *  · `deployment` —— 部署自己写的缺省(`DEFAULT_SCENARIO` / config `defaultScenario`)。
- * 请求体显式给的名字不在此列:那是调用方的话,不在册 ⇒ 400 `scenario_unknown`(见 {@link gateScenarioRequest})。
+ * 一次请求生效的场景名**从哪一层来**(闭集,唯一属主;wire 上 `GET /v1/capabilities/scenario` 的 `source`、`state.scenario_assignment_unknown` 拒体的 `source` 读的都是它):
+ *  · `request` —— 这次请求点了名(体 `scenario` / 场景头 `x-agent-scenario` / 读面的 `?scenario=`;点名读法 `request-form.ts` `scenarioRequestedBy`);
+ *  · `ruling` —— 没点名,中心按主体指派的场景(`ScenarioRuling.scenario`);
+ *  · `deployment` —— 没点名、也没有指派,部署自己写的缺省(`DEFAULT_SCENARIO` / config `defaultScenario`)。
+ * 新增一词 ⇒ 自铸登记 `selfMinted.scenarioSource` 的 `satisfies Record<ScenarioSource, …>` 编译红;链上两层另由 {@link danglingScenarioRefusal} 的穷尽 switch 判。
  */
-export type ScenarioNameSource = "ruling" | "deployment";
+export type ScenarioSource = "request" | "ruling" | "deployment";
+/**
+ * 指派链上的两层(请求没点名时走的链)—— 「名字悬空」只在这两层上成立:点名的不在册名是调用方的错,门先答 400 `scenario_unknown`,不走悬空判据。
+ * 所以 `state.scenario_assignment_unknown` 拒体的 `source` 只会是这两词。
+ */
+export type ScenarioChainSource = Exclude<ScenarioSource, "request">;
+/**
+ * **门的答**(唯一一种形):这次请求生效的场景名(一定在册)与它来自哪一层。提交腿、`run-local` 与每一张读面读的都是这一只答;
+ * `GET /v1/capabilities/scenario` 的 200 体就是它(键名同 wire)。
+ */
+export interface ScenarioChoice {
+    readonly scenario: string;
+    readonly source: ScenarioSource;
+}
 /**
  * 🔴 **悬空场景名的判据与拒句 —— 全仓唯一属主。**
  *
@@ -365,10 +379,10 @@ export type ScenarioNameSource = "ruling" | "deployment";
  * 返回 `undefined` = 在册;否则是**拒句**(点名名字与来源、给在册词表、说怎么修)。判据按**自有键**(`known` 是场景表的
  * `Object.keys`,`constructor` / `__proto__` 不是场景名)。
  */
-export declare function danglingScenarioRefusal(name: string, source: ScenarioNameSource, known: readonly string[]): string | undefined;
+export declare function danglingScenarioRefusal(name: string, source: ScenarioChainSource, known: readonly string[]): string | undefined;
 /**
- * resolveSpec 的执法入口(指派为默认、body.scenario 可换但限 allowlist)。返回本请求的
- * **在册**生效场景名 —— 返回值一定在 `known` 里:下游直接按它取场景,没有「未知名 → default」的回退臂。
+ * resolveSpec 的执法入口(指派为默认、body.scenario 可换但限 allowlist)。返回本请求的**门的答**({@link ScenarioChoice}):
+ * **在册**生效场景名 + 它来自哪一层 —— 名字一定在 `known` 里:下游直接按它取场景,没有「未知名 → default」的回退臂;来层在铸名的那一臂上同时写下,读面不另算。
  * 读数 `ruling` 三态各一条出路({@link ScenarioRulingRead}),判序:
  *
  *   1. body.scenario 显式给出而不在册 ⇒ typed 400 `scenario_unknown`(调用方的错;词表面先于治理面,不等中心)。
@@ -383,7 +397,7 @@ export declare function danglingScenarioRefusal(name: string, source: ScenarioNa
  *
  * `principal` 只进运维日志,不参与判定。
  */
-export declare function gateScenarioRequest(ruling: ScenarioRulingRead, bodyScenario: unknown, defaultScenario: string, known: readonly string[], logger?: Logger, principal?: string): string;
+export declare function gateScenarioRequest(ruling: ScenarioRulingRead, bodyScenario: unknown, defaultScenario: string, known: readonly string[], logger?: Logger, principal?: string): ScenarioChoice;
 /**
  * 一条请求的场景名过门 —— {@link gateScenarioRequest} 的**唯一一处实参装配**。
  *
@@ -393,8 +407,9 @@ export declare function gateScenarioRequest(ruling: ScenarioRulingRead, bodyScen
  * 每个读口自己拼一遍这六个实参 = 第二只门:两口对「在册」「放行」「缺席取谁」各判各的,读口就开始对不上 run。
  * 所以装配只在这里,读口持有的是**绑好的门**;凡回答这类问题的口,场景名都由门给 —— 点名与缺席都问。
  *
- * 契约:`(principal, requested) => 在册的场景名`(返回值一定在册;被拒 ⇒ 抛 {@link gateScenarioRequest} 的那几只 typed 错,
- * 读口不改写)。`requested` 非串(缺席)⇒ 门走指派链(ruling 胜者,否则部署缺省),与 run 时同一读法。
+ * 契约:`(principal, requested) => 门的答 { scenario, source }`({@link ScenarioChoice};名字一定在册;被拒 ⇒ 抛 {@link gateScenarioRequest} 的那几只 typed 错,
+ * 读口不改写)。`requested` 非串(缺席)⇒ 门走指派链(ruling 胜者,否则部署缺省),与 run 时同一读法。`requested` 由调用方经 `scenarioRequestedBy`
+ * (`request-form.ts`,场景头 × 点名的唯一读法)取 —— 提交腿与读面同调。
  * `principalCaps` 缺席(无中心 / 干跑 / 嵌入方 / `run-local`)⇒ 读数恒缺席,门走「请求名或部署缺省」那条链;
  * 在场 ⇒ 它的读数三态({@link ScenarioRulingRead})原样交门,故障态由门拒。
  */
@@ -411,14 +426,14 @@ export interface ScenarioGateSources {
     readonly logger?: Logger;
 }
 export interface ScenarioGate {
-    (principal: string | undefined, requested: unknown): Promise<string>;
+    (principal: string | undefined, requested: unknown): Promise<ScenarioChoice>;
     /** 在册词表 —— 门判「在不在册」读的**同一张**场景表的自有键(活读,不抄快照)。请求的场景头在分派层判在册读它(读面没有体,不过整只门)。 */
     readonly known: () => readonly string[];
 }
 /**
  * 门问中心裁定走哪条腿(闭集;新增一词 ⇒ 下面的穷尽 `switch` 编译红)—— 与 `resolveRuntimeCaps` / `peekRuntimeCapsReading` 是同一对:
  *  · `enforce` —— 任务提交腿:中心裁定走执法腿,center 硬失败铸下的 fail-closed 降级项两腿都认;
- *  · `peek` —— 读面(`GET /v1/capabilities/mcp` 状态面、`GET /v1/sessions/:id/mcp` / `…/a2a` 两张会话面板):只读腿,同一只缓存 / 同一条抓取 / 同一份读数(中心答不出 ⇒ 读面同拒),但硬失败铸的降级项只对读面自己算数,
+ *  · `peek` —— 读面(`GET /v1/capabilities/scenario` 生效场景面、`GET /v1/capabilities/mcp` 状态面、`GET /v1/sessions/:id/mcp` / `…/a2a` 两张会话面板):只读腿,同一只缓存 / 同一条抓取 / 同一份读数(中心答不出 ⇒ 读面同拒),但硬失败铸的降级项只对读面自己算数,
  *    不替这个主体的真提交留下 `{allowWorkflows:false, allowFork:false, autoMode:false}` 的短窗 deny(读面不许成为别人被拒的原因)。
  */
 export type ScenarioGateLeg = "enforce" | "peek";

package/dist/capabilities/scenarios.js

@@ -315,7 +315,7 @@ export function gateScenarioRequest(ruling, bodyScenario, defaultScenario, known
                 extra: { allowlist: allowed },
             });
         }
-        return bodyScenario;
+        return { scenario: bodyScenario, source: "request" };
     }
     const [name, source] = ruling?.scenario != null ? [ruling.scenario, "ruling"] : [defaultScenario, "deployment"];
     const refusal = danglingScenarioRefusal(name, source, known);
@@ -323,7 +323,7 @@ export function gateScenarioRequest(ruling, bodyScenario, defaultScenario, known
         logger?.warn("scenario_assignment_unknown", { scenario: name, source, ...(principal !== undefined ? { principal } : {}) });
         throw createCodedHttpError(503, "state.scenario_assignment_unknown", refusal, { scenario: name, source });
     }
-    return name;
+    return { scenario: name, source };
 }
 export function createScenarioGate(sources, leg) {
     const rulingOf = (principal) => {

package/dist/capability-facts.d.ts

@@ -21,8 +21,10 @@
 import type { FlatServiceDeps } from "./http/server.js";
 import type { ServiceConfig } from "./config.js";
 import type { OwnerAwareSessionStore } from "./security.js";
-import type { ServiceBlobExchange, ServiceFileHistoryStore, StoreBackend } from "./plugins/store-backend.js";
+import type { ServiceFileHistoryStore, StoreBackend } from "./plugins/store-backend.js";
+import type { OperatorPower, OperatorRoster } from "./operator-roster.js";
 import { resolveStreamApprovalGate, type ApprovalFrameFamily } from "./tool-approval.js";
+import { type LandingBlobFaces } from "./session-sync.js";
 import { type WorkspaceSyncCapability } from "./workspace-space.js";
 import type { WorkspaceCacheCapability } from "./workspace-cache.js";
 import type { HistoryAnchorReaders } from "./history-anchor.js";
@@ -53,7 +55,7 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly session_export_absent: "the session store has no entry export faces (exportEntries / exportEntriesStream)";
     readonly session_import_staging_absent: "the session store has no staged-import face (beginImportStaging)";
     readonly policy_purge_absent: "the session policy store has no deleteBySession purge verb";
-    readonly blob_exchange_absent: "the file-history store carries no blob exchange (FileHistoryStore.blobExchange — SQL backends only)";
+    readonly blob_exchange_absent: "the file-history store carries no complete blob face (the blob exchange FileHistoryStore.blobExchange together with the per-landing provenance face blobLanding — SQL backends only)";
     readonly device_hub_absent: "the device lane hub is not wired";
     readonly device_store_absent: "the device store is not wired";
     readonly device_enrollment_absent: "device enrollment is not wired";
@@ -82,8 +84,7 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly a2a_serve_off: "A2A_SERVE_ENABLED is off";
     readonly elicitation_disabled: "inbound MCP elicitation is off (MCP_ELICITATION_ENABLED)";
     readonly ask_question_disabled: "AskUserQuestion live HITL is off (ASK_QUESTION_ENABLED)";
-    readonly tool_approval_disabled: "live tool approval is off (TOOL_APPROVAL_ENABLED)";
-    readonly stream_approval_disabled: "the stream approval protocol is off (STREAM_APPROVAL_ENABLED)";
+    readonly tool_approval_disabled: "this worker presents no approval cards (needs TOOL_APPROVAL_ENABLED, a store backend (DB_BACKEND) and DURABLE_APPROVAL)";
     readonly read_root_grant_posture_refused: "this is not a single-user host-lane deployment (REMOTE_EXEC=host without REQUIRE_PRINCIPAL), the only posture that honors a read-directory grant";
     readonly background_agent_store_absent: "no background-agent store is wired";
     readonly sendfile_ledger_absent: "no SendUserFile ledger is wired";
@@ -227,11 +228,11 @@ export declare function sessionSync<D extends Pick<Deps, "backend" | "sessionSto
     sessionStorage: SyncSessionStore<D>;
     historyStore: ServiceFileHistoryStore;
 }>;
-/** 会话同步的**文件历史半族**:对话半族 ∧ 文件历史店带 blob 交换组(只有 SQL 两只店有)。「店能不能交换 blob」只在 `blobExchangeOf` 判一次(core 判官),
- *  blob 取值口 `blobGetterOf` 读的是同一只 —— 本事实为真 ⟺ 取值口通到 `blobExchange.get`;判过的组随事实交出,路由的 GET / PUT / 在场预检只读它。 */
+/** 会话同步的**文件历史半族**:对话半族 ∧ 文件历史店带完整的 blob 面 —— 交换组 + 按落点来历面(只有 SQL 两只店有)。「店有没有这只面」只在 `landingBlobFacesOf` 判一次
+ *  (交换组经 core 判官),判过的面随事实交出:路由的 PUT / 在场预检 / 重放取值 / GET 只读它(按落点,没有全局读者)。 */
 export declare function sessionSyncFileHistory(d: Pick<Deps, "backend" | "sessionStorage">): Fact<SessionSyncWhy | "blob_exchange_absent", {
     historyStore: ServiceFileHistoryStore;
-    blobExchange: ServiceBlobExchange;
+    blobs: LandingBlobFaces;
 }>;
 type RewindFilesWhy = "file_history_store_absent" | "session_head_face_absent" | "resume_anchor_store_absent" | "execution_lane_handless" | "workspace_rebuilt_per_task" | "session_store_shared";
 /**
@@ -272,7 +273,7 @@ export declare function askUserQuestion(d: Pick<Deps, "question">): Fact<"ask_qu
 export declare function toolApproval(d: Pick<Deps, "toolApproval">): Fact<"tool_approval_disabled", {
     coordinator: Store<"toolApproval">;
 }>;
-type StreamApprovalWhy = "tool_approval_disabled" | "stream_approval_disabled" | "store_backend_absent" | "checkpoint_store_absent";
+type StreamApprovalWhy = "tool_approval_disabled" | "store_backend_absent" | "checkpoint_store_absent";
 type ActiveStreamApproval = Extract<ReturnType<typeof resolveStreamApprovalGate>, {
     active: true;
 }>;
@@ -283,7 +284,7 @@ export declare function streamApproval(d: Pick<Deps, "toolApproval" | "config" |
 }>;
 /**
  * 读根授权(「Yes, and add directory」)这台部署**受理不受理** —— `GET /v1/capabilities` 的 `approvalReadRootGrant` 位,与
- * `POST /v1/tool-approvals/:id/respond` 对应答体 `readRootGrant` 的受理门**读同一只**(位说不受理而口照收,就是「位说 X、行为不是 X」)。
+ * 决断口 `POST /v1/tasks/:taskId/asks/:askId/decision` 对决定体 `readRootGrant` 的受理门**读同一只**(位说不受理而口照收,就是「位说 X、行为不是 X」)。
  *
  * 判据 = 部署形表行 `callerOwnsWorkerDisk`(手在本 worker 盘上 ∧ 单主;与调用方附加目录同一条信任边界):授权把一个**宿主目录**加进本 run 的读目录,
  * 只有「这台机器一个可信主人」的姿态才有这个授权的语义;多租户与云上 / 容器车道的读面另有归宿(沙箱内的读面档位见 `READ_FACE`)。
@@ -294,14 +295,13 @@ export declare function readRootGrant(d: Pick<Deps, "config">): Fact<"read_root_
 /**
  * 审批开卡帧的族 —— `GET /v1/capabilities` 的 `approvalFrameFamilies` 位。**值族投影**(出形是闭集词数组,不是 `{ available }`;同
  * `engineCapabilityBits` 一类),入参是 {@link streamApproval} **已求出的那一份事实**而不是 deps:一次请求里 `streamApproval` 位与本位读同一次判据求值
- * (判据读活配置与 backend,两次求值在开关热改的窗口里会撕出 `streamApproval:true` 配旧族的应答;也多取一次 ask 店)。
+ * (判据读活配置与 backend,两次求值会撕出两位互相矛盾的应答;也多取一次 ask 店)。
  *  · 流内审批在场(呈卡协议上场)⇒ `["approval_request"]`;
- *  · 活卡协调器在、协议没上场(开关关 / 无 store backend / 无 park 设施)⇒ `["tool_approval"]`;
- *  · 活卡协调器缺席 ⇒ `[]`(没有审批卡可呈)。
- * 对 why 闭集穷举:`streamApproval` 的拒因多一个 ⇒ 这里编译红,逼着给新拒因定族。三条执行腿选族读的是同一只判据的 `active`,
- * 与本映射的「在场 ⇒ 呈卡族」是同一条规则(真腿对拍钉在 `test/stream-approval-on-e2e.test.ts`)。没有端点按它拒:它是消费方分派帧族的读点,`streamApproval` 的词义不变。
- * [ref]:它也是壳**声明**的依据 —— 一条 run 只在 `settings.approvalFrameFamilies` 含本位那一个族时有活审批通道(三条腿判的是同一只映射
- * `presentedApprovalFrameFamily`);不含 ⇒ 这条腿不呈卡,问当场交无人值守政策口。本位的值不因声明而变。
+ *  · 其余每一形(审批席缺席 / 无 store backend / 无 park 设施)⇒ `[]`:这台 worker 不呈卡,每条腿的问当场交无人值守政策口
+ *    (审批只有一个帧族,没有「协议没上场就回退发另一族活卡」的腿)。
+ * 族词由 `presentedApprovalFrameFamily` 一处映射(三条执行腿判「这台 worker 呈不呈卡 / 这条 run 声明了没有」读同一只 —— 壳照本位声明,服务端照同一只函数判;
+ * 真腿对拍钉在 `test/stream-approval-on-e2e.test.ts`)。没有端点按它拒:它是消费方分派帧族与声明的读点,`streamApproval` 的词义不变。
+ * [ref]:一条 run 只在 `settings.approvalFrameFamilies` 含本位那一个族时有活审批通道;本位为空 ⇒ 这台 worker 上没有 run 有。本位的值不因声明而变。
  */
 export declare function approvalFrameFamilies(stream: ReturnType<typeof streamApproval>): readonly ApprovalFrameFamily[];
 export declare function deviceLane(d: Pick<Deps, "deviceHub">): Fact<"device_hub_absent", {
@@ -377,14 +377,16 @@ export declare function principalInboxDelivery(d: Pick<Deps, "orgDeliveryGate">)
 export declare function engineHandover(d: Pick<Deps, "drainState">): Fact<"engine_handover_lane_absent" | "engine_lease_stopped", {
     door: EngineHandoverDoor;
 }>;
-/** 这台部署有运维名册(名单非空 ∨ 单用户声明 `OPERATOR_SINGLE_USER`;唯一读法 `operatorRosterPresent`)。没有时 `explicitOperatorOk` 对任何身份恒假
- *  ⇒ 这一族的口对谁都打不通 = 部署不可用(不是鉴权拒)。
+/** 这台部署上有人能持这只运维权力(档表里持 `power` 的某档名单非空 ∨ 单用户声明 `OPERATOR_SINGLE_USER`;唯一读法 `operatorRosterPresent`)。没有时 `explicitOperatorOk(…, power)`
+ *  对任何身份恒假 ⇒ 这一族的口对谁都打不通 = 部署不可用(不是鉴权拒)。`power` 必填:运维面族传 `"operate"`,排空口传它声明行的 `power`。
+ *  原因词只有 `operator_principals_empty` 一个:全运维档持每一只权力,所以「没人持 `power`」恒蕴含「没有全运维」—— 这个词的义对每只权力都真;
+ *  各权力的完整出路句由 `sendOperatorPrincipalsRequired(res, power)` 在拒发口说。
  *
  * operator 族的复合事实**先判名单、再判设施**:门序是「身份 → 名单空(501)→ 授权(403)→ 设施缺席(501)」——
  * 名单空时没有人过得了授权,不先判它,这一形就永远答成 403;设施缺席则留在授权之后答(不对非 operator 透露部署形态)。 */
 export declare function operatorLane(d: {
-    readonly config: Pick<ServiceConfig, "operatorPrincipals" | "operatorSingleUser">;
-}): Fact<"operator_principals_empty">;
+    readonly config: OperatorRoster;
+}, power: OperatorPower): Fact<"operator_principals_empty">;
 /** 带收编日志的后端(见证随调用方的 deps:路由层的后端视图上店工厂照样封着)。 */
 type AdoptionCapableBackend<D extends Pick<Deps, "backend">> = Held<D, "backend"> & {
     adoptionLog(): ReturnType<NonNullable<Store<"backend">["adoptionLog"]>>;

package/dist/capability-facts.js

@@ -6,7 +6,7 @@ import { presentedApprovalFrameFamily, resolveStreamApprovalGate } from "./tool-
 import { selfOrchestrationDenial } from "./task-workflow.js";
 import { centerEntitlementSourceWired } from "./runtime-caps-resolver.js";
 import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
-import { blobExchangeOf } from "./session-sync.js";
+import { landingBlobFacesOf } from "./session-sync.js";
 import { overwriteWipeIncapable } from "./plugins/landed-attendants.js";
 import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, workspaceSnapshotTimeoutOf } from "./workspace-space.js";
 import { sessionKindFaceOf } from "./session-kind.js";
@@ -38,7 +38,7 @@ export const CAPABILITY_FACT_WHY = {
     session_export_absent: "the session store has no entry export faces (exportEntries / exportEntriesStream)",
     session_import_staging_absent: "the session store has no staged-import face (beginImportStaging)",
     policy_purge_absent: "the session policy store has no deleteBySession purge verb",
-    blob_exchange_absent: "the file-history store carries no blob exchange (FileHistoryStore.blobExchange — SQL backends only)",
+    blob_exchange_absent: "the file-history store carries no complete blob face (the blob exchange FileHistoryStore.blobExchange together with the per-landing provenance face blobLanding — SQL backends only)",
     device_hub_absent: "the device lane hub is not wired",
     device_store_absent: "the device store is not wired",
     device_enrollment_absent: "device enrollment is not wired",
@@ -49,7 +49,7 @@ export const CAPABILITY_FACT_WHY = {
     shared_memory_store_absent: "no shared memory store provider is wired",
     org_memory_directory_absent: "no org memory directory (membership fold) is wired",
     org_delivery_gate_absent: "no organization delivery gate is mounted (PRINCIPAL_INBOX_ASSISTANT is unset: the deployment declares no principal-inbox consumer)",
-    operator_principals_empty: `no operator roster (OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not declared), so no caller can ever be an operator; ${buildOperatorRosterWayOut()}`,
+    operator_principals_empty: `no operator roster (OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not declared), so no caller can ever be an operator; ${buildOperatorRosterWayOut("operate")}`,
     adoption_store_absent: "no adoption log store is wired (SQL backends only)",
     memory_bundle_faces_absent: "the memory engine's governance bundle faces are not wired",
     memory_compliance_faces_absent: "the memory engine's provenance/erasure faces are not wired",
@@ -67,8 +67,7 @@ export const CAPABILITY_FACT_WHY = {
     a2a_serve_off: "A2A_SERVE_ENABLED is off",
     elicitation_disabled: "inbound MCP elicitation is off (MCP_ELICITATION_ENABLED)",
     ask_question_disabled: "AskUserQuestion live HITL is off (ASK_QUESTION_ENABLED)",
-    tool_approval_disabled: "live tool approval is off (TOOL_APPROVAL_ENABLED)",
-    stream_approval_disabled: "the stream approval protocol is off (STREAM_APPROVAL_ENABLED)",
+    tool_approval_disabled: "this worker presents no approval cards (needs TOOL_APPROVAL_ENABLED, a store backend (DB_BACKEND) and DURABLE_APPROVAL)",
     read_root_grant_posture_refused: "this is not a single-user host-lane deployment (REMOTE_EXEC=host without REQUIRE_PRINCIPAL), the only posture that honors a read-directory grant",
     background_agent_store_absent: "no background-agent store is wired",
     sendfile_ledger_absent: "no SendUserFile ledger is wired",
@@ -217,8 +216,8 @@ export function sessionSyncFileHistory(d) {
     const sync = sessionSync(d);
     if (!sync.available)
         return sync;
-    const blobExchange = blobExchangeOf(sync.historyStore);
-    return blobExchange !== undefined ? yes({ historyStore: sync.historyStore, blobExchange }) : no("blob_exchange_absent");
+    const blobs = landingBlobFacesOf(sync.historyStore);
+    return blobs !== undefined ? yes({ historyStore: sync.historyStore, blobs }) : no("blob_exchange_absent");
 }
 export function sessionRewindFiles(d) {
     const { config, backend } = d;
@@ -262,7 +261,6 @@ export function streamApproval(d) {
     const coordinator = d.toolApproval;
     const gate = resolveStreamApprovalGate({
         toolApprovalEnabled: true,
-        streamApprovalEnabled: d.config.streamApproval?.enabled === true,
         backend: d.backend,
         checkpointStore: d.checkpointStore,
     });
@@ -271,8 +269,6 @@ export function streamApproval(d) {
     switch (gate.reason) {
         case "no_tool_approval":
             return no("tool_approval_disabled");
-        case "protocol_disabled":
-            return no("stream_approval_disabled");
         case "no_backend":
             return no("store_backend_absent");
         case "no_park_facility":
@@ -287,20 +283,8 @@ export function readRootGrant(d) {
     return DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(d.config) ? YES : no("read_root_grant_posture_refused");
 }
 export function approvalFrameFamilies(stream) {
-    if (stream.available)
-        return [presentedApprovalFrameFamily(true)];
-    switch (stream.why) {
-        case "tool_approval_disabled":
-            return [];
-        case "stream_approval_disabled":
-        case "store_backend_absent":
-        case "checkpoint_store_absent":
-            return [presentedApprovalFrameFamily(false)];
-        default: {
-            const unhandled = stream.why;
-            throw new Error(`unhandled stream-approval why: ${JSON.stringify(unhandled)}`);
-        }
-    }
+    const family = presentedApprovalFrameFamily(stream.available);
+    return family === undefined ? [] : [family];
 }
 export function deviceLane(d) {
     return d.deviceHub !== undefined ? yes({ hub: d.deviceHub }) : no("device_hub_absent");
@@ -377,15 +361,15 @@ export function engineHandover(d) {
         return no("engine_handover_lane_absent");
     return door.observing ? yes({ door }) : no("engine_lease_stopped");
 }
-export function operatorLane(d) {
-    return operatorRosterPresent(d.config) ? YES : no("operator_principals_empty");
+export function operatorLane(d, power) {
+    return operatorRosterPresent(d.config, power) ? YES : no("operator_principals_empty");
 }
 function adoptionLogStore(d) {
     const b = d.backend;
     return b !== undefined && typeof b.adoptionLog === "function" ? yes({ backend: b }) : no("adoption_store_absent");
 }
 export function adoption(d) {
-    const lane = operatorLane(d);
+    const lane = operatorLane(d, "operate");
     if (!lane.available)
         return lane;
     return adoptionLogStore(d);
@@ -400,7 +384,7 @@ export function adoptionSessionImport(d) {
     return yes({ backend: log.backend, sessionStorage: s });
 }
 export function memoryBundle(d) {
-    const lane = operatorLane(d);
+    const lane = operatorLane(d, "operate");
     if (!lane.available)
         return lane;
     return d.memoryBundleExport !== undefined && d.memoryBundleImport !== undefined
@@ -408,13 +392,13 @@ export function memoryBundle(d) {
         : no("memory_bundle_faces_absent");
 }
 export function memoryCompliance(d) {
-    const lane = operatorLane(d);
+    const lane = operatorLane(d, "operate");
     if (!lane.available)
         return lane;
     return d.memoryCompliance !== undefined ? yes({ faces: d.memoryCompliance }) : no("memory_compliance_faces_absent");
 }
 export function memoryOrigin(d) {
-    const lane = operatorLane(d);
+    const lane = operatorLane(d, "operate");
     if (!lane.available)
         return lane;
     return d.memoryOriginFace !== undefined ? yes({ faces: d.memoryOriginFace }) : no("memory_origin_faces_absent");
@@ -422,17 +406,17 @@ export function memoryOrigin(d) {
 export function memoryConsolidation(d) {
     if (d.memoryConsolidation === undefined)
         return no("consolidation_valve_closed");
-    const lane = operatorLane(d);
+    const lane = operatorLane(d, "operate");
     return lane.available ? yes({ valve: d.memoryConsolidation }) : lane;
 }
 export function memoryOptOutGrant(d) {
-    const lane = operatorLane(d);
+    const lane = operatorLane(d, "operate");
     if (!lane.available)
         return lane;
     return d.memoryOptOutGrant !== undefined ? yes({ store: d.memoryOptOutGrant }) : no("memory_optout_grant_absent");
 }
 export function outcomeLedger(d) {
-    const lane = operatorLane(d);
+    const lane = operatorLane(d, "operate");
     if (!lane.available)
         return lane;
     const sink = d.outcomeSink;
@@ -441,7 +425,7 @@ export function outcomeLedger(d) {
 export function configCatalog(d) {
     if (d.config.configCatalogEnabled !== true)
         return no("config_catalog_disabled");
-    return operatorLane(d);
+    return operatorLane(d, "operate");
 }
 export function ruleLane(d) {
     return d.ruleConsent !== undefined ? yes({ lane: d.ruleConsent }) : no("rule_store_absent");

package/dist/card-rule-offers.d.ts

@@ -0,0 +1,32 @@
+/**
+ * **一张审批卡的规则候选:唯一读者**(活卡铸点、两只 checkpoint 店的铸行与回读投影、停驻行的规则记录读者同调这一只)。
+ *
+ * 规则一句:每一张面上投出的候选,都是同一份记录过**这一只**读者得到的投影 —— 同一个下标空间。读法 = core `readRuleOffers` 的闭集词
+ * (经 `approval-card.ts` 的 `readRuleOfferList`)→ 基数前缀帽 {@link MAX_RULE_OFFERS}(扣在读之前:exact single 恒 0、batch 恒末,前缀截不动选择键)→
+ * 兑付座超尺整条撤回 → 派生事实一致性(自称的 kind / match / command / directory 座与共享校验器从 `rule` 文本派生的三元组逐字一致,且是这张卡的工具与卡形)。
+ * 此前店侧另有一只读者(超尺截长、不判派生事实):一只展示成目录授权、规则文本却是 Bash 放行的 offer 能在队列行上出现,同一张停驻卡的重放帧与队列行
+ * 下标对不上。展示变换(逐条脱敏 + 截长,1:1 保位、只改字)归各展示腿,不是读法(`checkpoint-store-face.ts` 的 `displayRuleOffers`)。
+ */
+import { type RuleOffer } from "@sema-agent/core";
+/**
+ * 读一张卡的候选(唯一读者;头注)。`undefined` = 没有素材可投 / 可兑:原值不是非空列表(引擎没铸),或有兑付座超了不可截的尺(整条车道撤回)。
+ * `[]` = 原值有、全被丢光(闭集词不认 / 派生事实不一致):活卡铸点据它把绑定值回落到调用自己的命令(编辑臂兑的就是它),展示腿读作无供给。
+ */
+export declare function readCardRuleOffers(raw: unknown, cardTool: string): readonly RuleOffer[] | undefined;
+/**
+ * **已落盘投影的解码**(SQL 腿的 `checkpoint.rule_suggestions` 列:铸行那一刻 {@link readCardRuleOffers} 读出、经展示变换落下的那一份)。读者在铸行时已经跑过;
+ * 这里只认闭集词形 + 同一组界(扫描窗 / 成员前缀 / 基数),**不再判**派生事实与兑付座尺 —— 展示形是脱敏、截长过的字(截长之后的规则文本不再是一条可解析的规则),
+ * 再过一遍读者会把铸行时留下的候选丢掉,同一份素材两个后端两种卡面。手改过的列由这只解码落成丢弃(响亮,同一只 offer-dropped 计数)。
+ */
+export declare function decodeRuleOfferProjection(raw: unknown): readonly RuleOffer[];
+/**
+ * 这张卡的**绑定值**(`prepareCardApproval` 的 `command`,也是耐久行的 `rule_command`)= **卡形的绑定值**(core `prepareCardApproval` 对 `command` 入参的逐形定义):
+ *  · 值形(整工具 / 名字 / 主机:core 对这三形只铸**一只** single,它的 `command` 座就是那个值 —— 整工具 `""`、名字工具是调用带的名字、主机工具是调用到达的主机)
+ *    ⇒ 那一只候选自己的 `command`;
+ *  · 其余(命令形候选 / 批,或读者把候选丢光了)⇒ 被裁决的命令原字节 `args.command`(非空串;读不出 ⇒ 没有素材)。空候选表不说任何值形:
+ *    绑定值回到调用自己的命令(编辑面兑的就是它)。
+ * 候选走到这里之前已过 {@link singleOfferBelongsOnCard}:每只 single 都是这张卡的工具、这只工具的卡形 ⇒ 值形与命令形不会同卡。值形候选不止一只 = 不是 core 铸得出的卡
+ * ⇒ 没有素材(整条车道撤回,与本文件其余撤回臂同形)。`req.args` 窄读,禁裸 as-cast。
+ */
+export declare function cardBindingOf(args: unknown, offers: readonly RuleOffer[]): string | undefined;
+//# sourceMappingURL=card-rule-offers.d.ts.map

package/dist/card-rule-offers.js

@@ -0,0 +1,130 @@
+import { MAX_RULE_TEXT_CHARS, parseRuleText } from "@sema-agent/core";
+import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, readRuleOfferList } from "./approval-card.js";
+import { CARD_RULE_FORM_OF_MATCH, cardRuleFormOf } from "./permission-rule-vocab.js";
+import { createLogger } from "./observability/logger.js";
+const defaultLogger = createLogger();
+export function readCardRuleOffers(raw, cardTool) {
+    if (raw === undefined)
+        return undefined;
+    if (!Array.isArray(raw)) {
+        readRuleOfferList(raw);
+        return undefined;
+    }
+    if (raw.length === 0)
+        return undefined;
+    return boundRuleOfferTexts(raw.slice(0, MAX_RULE_OFFER_SCAN).map(preboundBatchMembers), cardTool);
+}
+export function decodeRuleOfferProjection(raw) {
+    return readRuleOfferList(Array.isArray(raw) ? raw.slice(0, MAX_RULE_OFFER_SCAN).map(preboundBatchMembers) : raw)
+        .map(({ offer }) => offer)
+        .slice(0, MAX_RULE_OFFERS);
+}
+const MAX_RULE_OFFER_SCAN = 32;
+function preboundBatchMembers(item) {
+    if (typeof item !== "object" || item === null)
+        return item;
+    const candidate = item;
+    if (candidate.kind !== "batch" || !Array.isArray(candidate.rules) || candidate.rules.length <= MAX_RULE_OFFER_BATCH_MEMBERS)
+        return item;
+    return { ...candidate, rules: candidate.rules.slice(0, MAX_RULE_OFFER_BATCH_MEMBERS) };
+}
+function ruleOfferTextsOverSize(offer) {
+    const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
+    if (offer.kind === "single")
+        return over(offer.rule) || over(offer.command);
+    return offer.rules.some((r) => {
+        switch (r.kind) {
+            case "command":
+                return over(r.rule) || over(r.command);
+            case "directoryRead":
+                return over(r.rule) || over(r.directory);
+            default:
+                throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(r)}`);
+        }
+    });
+}
+function ruleOfferDerivedFactsAgree(offer, cardTool) {
+    const derive = (rule) => {
+        const p = parseRuleText(rule, "allow");
+        return "rule" in p ? p.rule : undefined;
+    };
+    if (offer.kind === "single") {
+        const d = derive(offer.rule);
+        return d !== undefined && d.rule === offer.rule && d.match === offer.match && d.command === offer.command && singleOfferBelongsOnCard(d.match, d.tool, cardTool);
+    }
+    return offer.rules.every((m) => {
+        const d = derive(m.rule);
+        if (d === undefined || d.rule !== m.rule)
+            return false;
+        switch (m.kind) {
+            case "command":
+                return d.tool === "Bash" && d.match === m.match && d.command === m.command;
+            case "directoryRead":
+                return d.tool === "Read" && d.match === "subpath" && d.command === m.directory;
+            default:
+                throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(m)}`);
+        }
+    });
+}
+function singleOfferBelongsOnCard(match, ruleTool, cardTool) {
+    const form = CARD_RULE_FORM_OF_MATCH[match];
+    return ruleTool === cardTool && form !== undefined && form === cardRuleFormOf(cardTool);
+}
+function boundRuleOfferTexts(offers, cardTool) {
+    const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
+    const clipSegment = (s) => (over(s) ? s.slice(0, MAX_RULE_TEXT_CHARS) : s);
+    const out = [];
+    for (const { offer } of readRuleOfferList(offers)) {
+        if (out.length >= MAX_RULE_OFFERS)
+            break;
+        if (ruleOfferTextsOverSize(offer))
+            return undefined;
+        if (!ruleOfferDerivedFactsAgree(offer, cardTool)) {
+            defaultLogger.warn("rule_offer_dropped_derived_facts_disagree", {
+                kind: offer.kind,
+                note: "an offer's kind/match/command/directory seats do not agree with what the shared validator derives from its rule text, or it is not this card's tool / card form — dropped whole so the card never shows one grant while redeeming another (core/dist skew or forged material?)",
+            });
+            continue;
+        }
+        switch (offer.kind) {
+            case "single":
+                out.push({ kind: "single", rule: offer.rule, match: offer.match, command: offer.command });
+                break;
+            case "batch": {
+                const rules = [];
+                for (const r of offer.rules) {
+                    switch (r.kind) {
+                        case "command":
+                            rules.push({ kind: "command", rule: r.rule, match: r.match, command: r.command, segment: clipSegment(r.segment) });
+                            break;
+                        case "directoryRead":
+                            rules.push({ kind: "directoryRead", rule: r.rule, directory: r.directory, segment: clipSegment(r.segment) });
+                            break;
+                        default:
+                            throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(r)}`);
+                    }
+                }
+                out.push({
+                    kind: "batch",
+                    rules,
+                    uncoveredSegments: offer.uncoveredSegments,
+                    ...(offer.uncoveredDetail !== undefined ? { uncoveredDetail: offer.uncoveredDetail.map((d) => ({ segment: clipSegment(d.segment), reason: d.reason })) } : {}),
+                });
+                break;
+            }
+            default:
+                throw new Error(`unknown rule-offer kind: ${JSON.stringify(offer)}`);
+        }
+    }
+    return out;
+}
+export function cardBindingOf(args, offers) {
+    const valueOffers = offers.filter((o) => o.kind === "single" && CARD_RULE_FORM_OF_MATCH[o.match] !== "command");
+    if (valueOffers.length > 0)
+        return valueOffers.length === 1 && offers.length === 1 ? valueOffers[0].command : undefined;
+    if (args === null || typeof args !== "object" || Array.isArray(args))
+        return undefined;
+    const command = args.command;
+    return typeof command === "string" && command !== "" ? command : undefined;
+}
+//# sourceMappingURL=card-rule-offers.js.map