@sema-agent/server 7.2.0 → 7.4.0

package/dist/capabilities/oa-tools.js

@@ -0,0 +1,54 @@
+import { Type } from "typebox";
+import { stablePrompt } from "./prompt.js";
+async function oaFetch(ctx, path, init) {
+    if (!ctx.baseUrl || !ctx.token)
+        return "OA 后端未配置(OA_API_BASEURL / OA_SERVICE_TOKEN)";
+    try {
+        const res = await fetch(ctx.baseUrl + path, {
+            method: init?.method ?? "GET",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${ctx.token}`,
+                ...(ctx.principal ? { "x-agent-principal": ctx.principal } : {}),
+            },
+            body: init?.body !== undefined ? JSON.stringify(init.body) : undefined,
+        });
+        const text = await res.text();
+        if (!res.ok)
+            return `OA ${res.status}: ${text.slice(0, 600)}`;
+        return text.slice(0, 60_000);
+    }
+    catch (e) {
+        return `调用 OA 失败：${e.message}`;
+    }
+}
+const needWrite = (ctx) => (!ctx.principal ? "缺少身份(principal)，无法代表用户写库；请让调用方带上 x-agent-principal。" : null);
+export function oaTools(ctx) {
+    const obj = Type.Object({}, { additionalProperties: true });
+    return [
+        { name: "oa_schema", effect: "read", description: "取 OA 数据结构(每类资产的字段/必填/条件必填 requiredWhen/联动 showWhen/枚举、生命周期、表名)。建/改前先调它，别凭记忆。", parameters: Type.Object({}), execute: () => oaFetch(ctx, "/api/v1/meta") },
+        { name: "oa_alerts", effect: "read", description: "派生告警：GP 闲置(已注册未变现) / APP 未上架(已接广告未 LIVE)。", parameters: Type.Object({}), execute: () => oaFetch(ctx, "/api/v1/alerts") },
+        { name: "oa_list", effect: "read", description: "列出某类资产。type∈gp/package/ad-platform/ad-unit/email/environment/proxy。可选 q 关键字。", parameters: Type.Object({ type: Type.String(), q: Type.Optional(Type.String()) }), execute: (a) => { const x = a; return oaFetch(ctx, `/api/v1/entities/${encodeURIComponent(x.type)}${x.q ? `?q=${encodeURIComponent(x.q)}` : ""}`); } },
+        { name: "oa_get", effect: "read", description: "取某资产详情(敏感字段为掩码)。", parameters: Type.Object({ type: Type.String(), id: Type.String() }), execute: (a) => { const x = a; return oaFetch(ctx, `/api/v1/entities/${encodeURIComponent(x.type)}/${encodeURIComponent(x.id)}`); } },
+        { name: "oa_lookup", effect: "read", description: "约定字段值反查(同手机/证件=同一实物)。field: phone|idCardNo|bizLicenseNo。", parameters: Type.Object({ field: Type.String(), value: Type.String() }), execute: (a) => { const x = a; return oaFetch(ctx, `/api/v1/lookup?field=${encodeURIComponent(x.field)}&value=${encodeURIComponent(x.value)}`); } },
+        { name: "oa_create", effect: "write", description: "创建实体(走 OA 校验+当前用户 RBAC+审计)。type + data(字段对象，参照 oa_schema)。失败会返回缺失/非法字段。", parameters: Type.Object({ type: Type.String(), data: obj }), execute: (a) => { const e = needWrite(ctx); if (e)
+                return e; const x = a; return oaFetch(ctx, `/api/assets/${encodeURIComponent(x.type)}`, { method: "POST", body: x.data ?? {} }); } },
+        { name: "oa_update", effect: "write", description: "改字段(敏感留空=保持原值；状态字段改不动，用 oa_transition)。", parameters: Type.Object({ type: Type.String(), id: Type.String(), data: obj }), execute: (a) => { const e = needWrite(ctx); if (e)
+                return e; const x = a; return oaFetch(ctx, `/api/assets/${encodeURIComponent(x.type)}/${encodeURIComponent(x.id)}`, { method: "PATCH", body: x.data ?? {} }); } },
+        { name: "oa_transition", effect: "write", description: "受控状态流转(先 oa_schema 看可用迁移；风险/弃用等需 note)。", parameters: Type.Object({ type: Type.String(), id: Type.String(), to: Type.String(), note: Type.Optional(Type.String()) }), execute: (a) => { const e = needWrite(ctx); if (e)
+                return e; const x = a; return oaFetch(ctx, `/api/assets/${encodeURIComponent(x.type)}/${encodeURIComponent(x.id)}/transition`, { method: "POST", body: { to: x.to, note: x.note ?? null } }); } },
+    ];
+}
+// OA business prompt MOVED OUT — migration complete (design/29, 2026-06-05). Persona / 工作准则 / UI
+// markers (::FORM:: / ::GOTO:: / ::SUGGEST:: / ::ISSUE_FORM::) / 分级确认 / 报bug流程 are OA's business,
+// and OA now injects the WHOLE thing per request via `request.systemPrompt` (it holds the service token,
+// content is stable per OA version → cacheable prefix; page context still rides `objective`). Keeping
+// any of it here would just DUPLICATE OA's prompt, so the base is EMPTY — single source of truth = OA.
+// The service stays business-agnostic: it provides the oa_* tools (referenced by NAME from OA's prompt;
+// they carry their own descriptions) and nothing else. `stablePrompt` keeps STABLE→VARIABLE order —
+// OA's systemPrompt is appended after this (empty) base, before core's <user_memory>.
+// (::ISSUE_FORM:: is parsed/rendered + submitted entirely by OA's frontend via OA /api/ai/issue — the
+//  service never touches it; `open_gitea_issue` remains only as the unattended/automated fallback.)
+const OA_SYSTEM = "";
+export const oaPrompt = stablePrompt(OA_SYSTEM);
+//# sourceMappingURL=oa-tools.js.map

package/dist/config-types.d.ts

@@ -9,6 +9,7 @@ import type { SealedKeyPoison } from "./sealed-key.js";
 import type { McpServerSpec, Model, ModelRoles } from "@sema-agent/core";
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 import type { ElicitationThrottle } from "./elicitation.js";
+import type { QuestionThrottle } from "./question.js";
 import type { InfraCostRates } from "./observability/cost-taxonomy.js";
 import type { Autonomy, CommandRule } from "./runtime-governance.js";
 /** A sema-registry MCP server resolved to a core spec (env-NAME refs already → real values) plus the
@@ -21,6 +22,44 @@ export interface ScopedMcpServer {
  *  off (the control plane never mounts). The runner-facing facts (the runner principal, the build-host CACHE_BASE,
  *  the default base ref) live here so image-api injects only VETTED, server-fixed values into the build.sh argv —
  *  operator free-text never reaches the runner. */
+/** #151 车3(design/172 流内审批协议)的配置面。总开关默认 **false**;四个从属旋钮只在开关为真时生效
+ *  (语义与「谁需要 / 谁被伤 / 什么补偿」三问见 `ServiceConfigFlat.streamApproval` 的注)。 */
+export interface StreamApprovalConfig {
+    /** 协议总开关。`STREAM_APPROVAL_ENABLED`,默认 **false**。关 ⇒ 全链逐字现行为。
+     *  翻真要等回决端点(车4)与对账收敛器(车5)到位——在此之前是个不完整协议(有卡无正规回决口、
+     *  有 PARKING 无收敛器、跨副本回决无唤醒路径)。 */
+    enabled: boolean;
+    /** 开关为真时作为 `ToolApprovalCoordinator` 的 `ttlMs`(design/172 §3.3 的「配置窗默认」)。
+     *  `STREAM_ASK_WINDOW_MS`,默认 **60000**。`0` = 运维显式关窗 ⇒ 恒 park(§3.3 窗=0 语义)。
+     *  开关为假 ⇒ 本值不参与,窗保持既有 `DEFAULT_APPROVAL_TTL_MS`(5min)。 */
+    windowMs: number;
+    /** 开流重放(§5)每次最多投几张未决卡——**读面**的帽,超出只投最新的并记一次 warn,开流不失败。
+     *  `STREAM_APPROVAL_REPLAY_MAX`,默认 **50**。 */
+    replayMax: number;
+    /** 写侧准入门(§0 X-2)的 per-task 未决 ask 上限。超限 ⇒ 在落 pending/建 timer/发帧**之前**返回
+     *  `"unavailable"`(park 路由,**永不 deny**——过载 bypass 到 park 是 §3.3 的硬条款)。
+     *  `STREAM_APPROVAL_ADMIT_MAX_PER_TASK`,默认 **32**。消费点在刀 3b。 */
+    admitMaxPerTask: number;
+    /** 同上,per-owner(租户)维。`STREAM_APPROVAL_ADMIT_MAX_PER_OWNER`,默认 **256**。 */
+    admitMaxPerOwner: number;
+    /** #151 车5 §5 治理旋钮(全部 `numEnvBounded` 有界解析,§9 C6)—— 对账收敛器每 tick **每段**
+     *  (PARKING / 孤儿 STREAM_PENDING)最多处理的行数。超出的下轮接着扫(靠 `deferReconcile` 的队列
+     *  轮转保证「接着」是真的,不是永远同一批)。`STREAM_APPROVAL_RECONCILE_BATCH`,默认 **200**,
+     *  有界 [1, 10000]。 */
+    reconcileBatch: number;
+    /** 崩溃恢复扫描的**宽限**(§8 D-1.1):只有 `expiresAtMs + 本值 < now` 的孤儿 `STREAM_PENDING` 行才
+     *  被 reaper 代打 `expireAsk`。活属主进程里的窗到期竞争者在这个宽限内常态必胜 ⇒ reaper 退回纯崩溃
+     *  兜底,不与在场闭包抢(抢 = 制造挂死面)。`STREAM_APPROVAL_PENDING_GRACE_MS`,默认 **30000**,
+     *  有界 [0, 3600000]。 */
+    pendingGraceMs: number;
+    /** 判据 4(adhoc 腿)的窗后宽限。`STREAM_APPROVAL_ADHOC_GRACE_MS`,默认 **60000**,有界 [0, 86400000]。
+     *  🔴 跨旋钮不变量:必须 **< `orphanTtlMs`**(否则判据 5 的兜底会先于判据 4 触发,adhoc 腿拿到的
+     *  归因就成了 `orphan_ttl_exceeded`,归因诚实性失效)——boot 期校验,破坏形**拒启**。 */
+    adhocGraceMs: number;
+    /** 判据 5(遗孤最终可判)的上界,量 immutable 的 `createdAtMs`。`STREAM_APPROVAL_ORPHAN_TTL_MS`,
+     *  默认 **7d**,有界 [60000, 90d]。 */
+    orphanTtlMs: number;
+}
 export interface ImageBakeConfig {
     enabled: boolean;
     /** The dedicated operator principal the bake-runner authenticates as on the internal claim/ingest routes
@@ -793,12 +832,40 @@ export interface ServiceConfigFlat {
      *  stream (the durable-suspend leg is wired separately). A CC cap → posture-gated (single-user turnkey →
      *  ON; multi-tenant opt-in); `ASK_QUESTION_ENABLED=true/false` overrides. */
     askQuestionEnabled: boolean;
+    /** #166 裁2:AskUserQuestion 的**裁量窗**——每 run 腿的并发帽 / 总量帽 / 无人应答的释放窗。窗用尽或到期
+     *  不是拒绝、也不是替人作答:协调器报 `unavailable`,落点(durable park / 非 durable 合成续跑)归 core。
+     *  `QUESTION_MAX_CONCURRENT_PER_RUN`(默认 2)/ `QUESTION_MAX_TOTAL_PER_RUN`(20)/ `QUESTION_TTL_MS`
+     *  (300000),越界值启动期响亮拒(照 `MCP_ELICITATION_*` 同门,不静默夹取)。缺席 ⇒ 协调器出厂窗
+     *  {@link import("./question.js").DEFAULT_QUESTION_THROTTLE}(与本旋钮族默认逐字同值)。 */
+    questionThrottle?: QuestionThrottle;
     /** [816]/[820]② live tool-approval HITL — mount the ToolApprovalCoordinator on `RunnerDeps.onAsk` + the
      *  `POST /v1/tool-approvals/:id/respond` route so a policy `ask` (the fs-write gate, ask-lists, non-durable safety
      *  asks) routes to the live human as the CC three-choice card on the run's stream (core 1.290 sync-ask leg). A CC
      *  cap → posture-gated like askQuestion (single-user turnkey → ON; multi-tenant opt-in);
      *  `TOOL_APPROVAL_ENABLED=true/false` overrides. Absent ⇒ core's headless auto-deny stands ([819]⑤ fail-closed). */
     toolApprovalEnabled: boolean;
+    /** #151 车2(design/172 §3.3 D3,窗长三元的安全余量):`ToolApprovalCoordinator` 的可选 `windowMarginMs`
+     *  构造项——有效窗 = `min(ttlMs, legRemainingMs − 本值)`,余量不足 ⇒ 不开窗直接走窗到期同路(park）。
+     *  仅在装配点把 `ToolApprovalRunContext.legDeadlineMonotonic` 传给协调器(车3 的活)时才实际生效——本
+     *  旋钮本身缺省对现行为零影响(D1)。`STREAM_ASK_WINDOW_MARGIN_MS`,默认 10000(10s）。ttl 概念沿用既有
+     *  `approvalTimeoutSec` 族,本旋钮不新增第二个 TTL 概念。 */
+    streamAskWindowMarginMs: number;
+    /** #151 车3(design/172 流内审批协议)总开关 + 四个从属旋钮。**协议整体默认 OFF**——开关关闭时全链
+     *  逐字现行为:不发 `approval_request` 帧、不落 `approval_asks` 行、窗 = 既有 `DEFAULT_APPROVAL_TTL_MS`
+     *  (5min)、`askStore` 不注入协调器。理由(三问):
+     *   - 谁需要 60s 窗:开了协议的部署——approver 就盯着流、秒级应答,窗短 ⇒ 少占一条活腿、更快落到可恢复
+     *     的 park 面。这是协议的设计意图,不是随手取的数。
+     *   - 谁被伤:①未 opt-in 的存量部署(把 5min 砍成 60s = 人离开工位 90 秒回来卡已经没了);②**park 设施
+     *     不在场**的部署——窗到期后 `"unavailable"` 没有降级目的地,core fail-closed deny,60s 会把
+     *     「人 90 秒后批准 = 放行」变成「拒绝」,是真行为回归。
+     *   - 补偿:把 60s 绑在**新旋钮 + 新开关**上,一个字不动 `DEFAULT_APPROVAL_TTL_MS`;两边都不伤,也不给
+     *     既有腿新增第二个 TTL 概念。
+     *
+     *  `STREAM_APPROVAL_ENABLED` / `STREAM_ASK_WINDOW_MS` / `STREAM_APPROVAL_REPLAY_MAX` /
+     *  `STREAM_APPROVAL_ADMIT_MAX_PER_TASK` / `STREAM_APPROVAL_ADMIT_MAX_PER_OWNER` /
+     *  `STREAM_APPROVAL_RECONCILE_BATCH` / `STREAM_APPROVAL_PENDING_GRACE_MS` /
+     *  `STREAM_APPROVAL_ADHOC_GRACE_MS` / `STREAM_APPROVAL_ORPHAN_TTL_MS`(后四键 = 车5 收敛器)。 */
+    streamApproval: StreamApprovalConfig;
     /** [824]① (clay A 案 = workflow 权限全面 CC parity): workflow 子 agent 的默认权限基线与主 LLM 同权(base `{}`)。
      *  安全论证:主 LLM 与子 agent 同 root 同信任域,主 LLM 本就能写这棵树([816] ask 门照管),单独钳子 agent 的
      *  安全增益≈0(只防绕路不防直路的门不是边界);实测产品代价=[814]A 死锁。`WORKFLOW_AGENTS_READONLY=true` =
@@ -915,7 +982,7 @@ export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "ses
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
-export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "askQuestionEnabled" | "toolApprovalEnabled" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate">;
+export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "streamAskWindowMarginMs" | "streamApproval" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memorySync" | "memoryOrgAdmissionMode" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析

package/dist/config.d.ts

@@ -60,6 +60,7 @@ export declare function drainConfigNotices(): Array<{
  *  (run-local historically did exactly that), so the drain lives beside the collectors, not in one entrypoint. */
 export declare function logConfigDiagnostics(logger: {
     warn: (event: string, fields?: Record<string, unknown>) => void;
+    info?: (event: string, fields?: Record<string, unknown>) => void;
     debug?: (event: string, fields?: Record<string, unknown>) => void;
 }): void;
 /** design/158 N8/N9 — the BOOLEAN member of this module's env-parser family (`env`/`env2`/`numEnv`/

package/dist/config.js

@@ -5,6 +5,7 @@ import { CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, pr
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/registry-core";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js"; // design/158 A4: the parser leaf — NOT security.js (base config layer must not value-import the 55KiB auth module)
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
+import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 function csv(name) {
     return (process.env[name] ?? "")
         .split(",")
@@ -188,6 +189,30 @@ const CONFIG_NOTICES = [];
 export function drainConfigNotices() {
     return CONFIG_NOTICES.splice(0, CONFIG_NOTICES.length);
 }
+/** #157([2762]§五,F 类观测,零行为变化)—— 本次 boot 的执行车道落点 + 它的来源。
+ *  为什么单开一格:REMOTE_EXEC 未设/空串时的落点由 CONFIG_PROVIDER 隐式决定(local ⇒ host 真机,其余 ⇒
+ *  进程内 stub),而这个落点此前在日志里零留痕 —— 运维拿到一台 worker,无从确认「它跑的是哪条执行通道、
+ *  是显式配的还是默认落的」。与 CONFIG_WARNINGS / CONFIG_NOTICES 同为 pre-logger 收集(config 解析早于
+ *  logger 建立),但级别是 **info**:这是每次 boot 都成立的常态事实,不是异常,而 CONFIG_NOTICES 那一格
+ *  固定按 warn 排空。
+ *  单槽(不是队列):一次 boot 只有一个落点;重复 loadConfig(测试)覆写即可,不会堆积。
+ *  ⚠️ 写入时机=装配尾(见 loadConfig),不是解析途中:写早了,任何**后置**拒启(limits 域数值、跨域
+ *  不变量)都会留下一条「其实没启起来」的落点;而 loadConfig 开头的清槽保证失败的一轮不会把**上一轮**
+ *  的落点串给下一次排空(交叉复审 medium,2026-08-06)。
+ *  ⚠️ 边界:记的是 **ENV 解析出的**落点。local 形的 `config.d/remote-exec.json` 覆写发生在 main.ts 的
+ *  applyLocalRemoteExec(晚于本行排空),它自己另记 `remote_exec_from_file` —— 两行合读才是最终 lane。 */
+let EXEC_LANE_NOTICE;
+/** 从**已装配好的** remoteExec 派生落点一行(而不是在 REMOTE_EXEC 那条三元链的各臂里分别记账):
+ *  分臂记账要靠「校验过了 ⇒ 必落对应那一臂」这条人肉维护的同源假设,链子哪天多一臂就悄悄失真;
+ *  取装配结果则天然跟随。`in-process` = REMOTE_EXEC 未设的进程内 stub 姿态,沿用既有词表
+ *  (config-center/types.ts 的 provider 词表、run-local 的 `?? "in-process"` 同名)。 */
+function buildExecLaneNotice(remoteExec) {
+    const explicit = process.env.REMOTE_EXEC !== undefined && process.env.REMOTE_EXEC !== "";
+    return {
+        lane: remoteExec?.provider ?? "in-process",
+        source: explicit ? "explicit-env" : process.env.CONFIG_PROVIDER === "local" ? "default-local-provider" : "default-unset",
+    };
+}
 /** F10 (codex audit): drain + log BOTH pre-logger diagnostic collectors (S20 soft-knob warnings + [792]④ boot
  *  notices) in one place. EVERY entrypoint that calls loadConfig() then builds a logger must call this right
  *  after (main.ts, run-local.ts) — a new entry that forgets it would silently drop operator-facing diagnostics
@@ -197,6 +222,13 @@ export function logConfigDiagnostics(logger) {
         logger.warn("config_env_invalid_using_default", { env: w.env, raw: w.raw });
     for (const n of drainConfigNotices())
         logger.warn(n.event, n.fields);
+    // #157 F 类观测:执行车道落点一行(见 EXEC_LANE_NOTICE 头注)。无条件发 —— boot 期本来就只跑一次,
+    // 不需要 once-per-hit 抑制。先取后清:排空语义与上面两格一致(重复调用不重放同一条)。`info` 与
+    // `debug` 同为可选,理由同上 —— 老 embedder 传进来的 warn-only logger 仍能编译、仍拿得到警告。
+    const laneNotice = EXEC_LANE_NOTICE;
+    EXEC_LANE_NOTICE = undefined;
+    if (laneNotice && logger.info)
+        logger.info("exec_lane_selected", { lane: laneNotice.lane, source: laneNotice.source });
     // design/158 N9 (polarity self-report): a `*_ENABLED` suffix does NOT carry its default — the repo grew four
     // dialects for it (opt-in / opt-out / posture tri-state / negative name). Rather than force operators to read
     // config.ts to learn what a knob does when unset, boolEnv-parsed knobs register themselves and we print one
@@ -874,6 +906,45 @@ export function formatUnmatchableToolNames(source, bad) {
     return (`${source} names tool(s) that can never match a live tool (core 5.0.0 RB-476 — the alias/auto-prefix folds are gone): ` +
         bad.map((b) => `${b.name} → ${b.guidance}`).join("; "));
 }
+/**
+ * #151 流内审批协议(design/172)的九键段(车3 刀 3a 五键 + 车5 收敛器四键)。
+ *
+ * **总开关默认 false** ⇒ 全链逐字现行为(不发 approval_request、不落 ask 行、不起收敛器腿、窗仍是
+ * `DEFAULT_APPROVAL_TTL_MS`)。窗/帽四键沿用 `numEnv` fail-loud 形(坏形启动期炸,不静默折 NaN);
+ * 车5 的四键一律 **`numEnvBounded`**(§9 C6:batch 整数 ≥1 有上帽,grace/TTL 非负有界)——它们直接
+ * 决定 reaper 每 tick 的库压与「多久算遗孤」,一个手滑的 `0` 或 `1e12` 都是运维事故面。
+ *
+ * 🔴 跨旋钮不变量(§9 C6,`#157` 三分类 P 族姿势):`ADHOC_GRACE < ORPHAN_TTL`。破坏形**拒启** ——
+ * 若 adhoc 宽限 ≥ 遗孤 TTL,判据 5 会先于判据 4 触发,一条 adhoc 腿拿到的归因就成了
+ * `orphan_ttl_exceeded`(「遗孤兜底」)而不是 `adhoc_leg_no_durable_domain`(「结构上无对账域」),
+ * 审计面从此读不出真实成因。默认值(60s vs 7d)自然满足;只有显式改坏才会撞上。
+ */
+function streamApprovalConfig() {
+    const cfg = {
+        enabled: boolEnv("STREAM_APPROVAL_ENABLED", false),
+        windowMs: numEnv("STREAM_ASK_WINDOW_MS", "60000"),
+        replayMax: numEnv("STREAM_APPROVAL_REPLAY_MAX", "50"),
+        admitMaxPerTask: numEnv("STREAM_APPROVAL_ADMIT_MAX_PER_TASK", "32"),
+        admitMaxPerOwner: numEnv("STREAM_APPROVAL_ADMIT_MAX_PER_OWNER", "256"),
+        reconcileBatch: numEnvBounded("STREAM_APPROVAL_RECONCILE_BATCH", "200", 1, 10_000),
+        pendingGraceMs: numEnvBounded("STREAM_APPROVAL_PENDING_GRACE_MS", "30000", 0, 3_600_000),
+        adhocGraceMs: numEnvBounded("STREAM_APPROVAL_ADHOC_GRACE_MS", "60000", 0, 86_400_000),
+        orphanTtlMs: numEnvBounded("STREAM_APPROVAL_ORPHAN_TTL_MS", String(7 * 24 * 60 * 60 * 1000), 60_000, 90 * 24 * 60 * 60 * 1000),
+    };
+    // 🔴 不变量的**正确形**(codex 交叉复审 C7,2026-08-06 验真):两条臂量的不是同一个起点 ——
+    // 判据 4 在 `expiresAtMs + ADHOC_GRACE` 触发,而 `expiresAtMs ≈ createdAtMs + WINDOW`;判据 5 在
+    // `createdAtMs + ORPHAN_TTL` 触发。只比 `ADHOC_GRACE < ORPHAN_TTL` 会漏掉窗:例如 WINDOW 与
+    // ORPHAN_TTL 等长时校验放行,但遗孤兜底必定先到,adhoc 腿的归因被写成 `orphan_ttl_exceeded`。
+    // 正确判据 = `WINDOW + ADHOC_GRACE < ORPHAN_TTL`(两边都是有界有限值,不会溢出)。
+    if (cfg.windowMs + cfg.adhocGraceMs >= cfg.orphanTtlMs) {
+        throw new Error(`env STREAM_ASK_WINDOW_MS=${cfg.windowMs} + STREAM_APPROVAL_ADHOC_GRACE_MS=${cfg.adhocGraceMs} must be STRICTLY LESS than STREAM_APPROVAL_ORPHAN_TTL_MS=${cfg.orphanTtlMs} — the adhoc arm fires at (createdAt + window + grace) while the orphan backstop fires at (createdAt + ttl); if the backstop wins, every adhoc-leg row is attributed "orphan_ttl_exceeded" instead of "adhoc_leg_no_durable_domain" (attribution honesty, design/172 §6.1)`);
+    }
+    // 整数门(batch 是行数,不是时长):`numEnvBounded` 只管区间,`200.5` 会一路走到 SQL `LIMIT` 上。
+    if (!Number.isInteger(cfg.reconcileBatch)) {
+        throw new Error(`env STREAM_APPROVAL_RECONCILE_BATCH=${cfg.reconcileBatch} must be an INTEGER row count`);
+    }
+    return cfg;
+}
 function parseApprovalDomain(ctx) {
     const { postureOn } = ctx; // 跨域入参②:posture 三态(single-user turnkey ⇒ HITL 面默认 ON)
     // design/80 D-G: the direct-connect approval door anchors (all must be present to ACTIVATE; fail-closed).
@@ -928,7 +999,21 @@ function parseApprovalDomain(ctx) {
             },
         },
         askQuestionEnabled: postureOn("ASK_QUESTION_ENABLED"), // §4④ AskUserQuestion live HITL; posture-gated (single-user → ON)
+        // #166 裁2:AskUserQuestion 裁量窗三旋钮,姿势照 MCP_ELICITATION_* 抄(bounded ⇒ 越界启动期拒,不静默
+        // 夹取)。默认值 = 协调器出厂窗逐字(纯旋钮化,零行为改动)。
+        questionThrottle: {
+            maxConcurrentPerRun: numEnvBounded("QUESTION_MAX_CONCURRENT_PER_RUN", String(DEFAULT_QUESTION_THROTTLE.maxConcurrentPerRun), 1, 64),
+            maxTotalPerRun: numEnvBounded("QUESTION_MAX_TOTAL_PER_RUN", String(DEFAULT_QUESTION_THROTTLE.maxTotalPerRun), 1, 10_000),
+            ttlMs: numEnvBounded("QUESTION_TTL_MS", String(DEFAULT_QUESTION_THROTTLE.ttlMs), 1_000, 3_600_000),
+        },
         toolApprovalEnabled: postureOn("TOOL_APPROVAL_ENABLED"), // [816]/[820]② live tool-approval HITL; posture-gated (single-user → ON), mirrors askQuestion
+        // #151 车2(design/172 §3.3 D3):ToolApprovalCoordinator 窗长三元的安全余量。numEnv fail-loud 形,
+        // 照邻居旋钮(approvalTimeoutSec 等)抄——坏形（非数字)在启动期炸,不静默折成 NaN。
+        streamAskWindowMarginMs: numEnv("STREAM_ASK_WINDOW_MARGIN_MS", "10000"),
+        // #151 车3 刀 3a(design/172 流内审批协议):五键。**总开关默认 false** ⇒ 全链逐字现行为(不发
+        // approval_request、不落 ask 行、窗仍是 DEFAULT_APPROVAL_TTL_MS)。窗/帽四键与邻居旋钮同 numEnv
+        // fail-loud 形——坏形在启动期炸,不静默折 NaN。语义与三问分析见 config-types.ts 的 StreamApprovalConfig。
+        streamApproval: streamApprovalConfig(),
         // [875]a 成文:0(缺省)= durable HITL 无限期等人,时间型 reapSuspended 不跑;file/memory lane 的回收
         // 探针只在 DURABLE_APPROVAL=true 时注入(无 durable 的部署两只 suspended 回收器恒 NO-OP,parked 行的
         // 恢复把手 = POST /v1/runs/:id/cancel,[868]①)。checkpoint 过期驱动的那只不受本旋钮门控。
@@ -1099,6 +1184,37 @@ function parseOrchestrationDomain(ctx) {
         }
         return boolEnv("LSP_HOST_ENABLED", true);
     })();
+    // ── #157([2755] tag `server.exec-lane.silent-downgrade-to-host`,P 类车道选择)——执行车道的
+    // fail-closed 校验。旧形:REMOTE_EXEC 点名了一条 lane 但必需 env 不全(或值拼错不在闭集里)时,下面
+    // 三元链的合取逐臂失败、静默滑穿到尾部 ⇒ CONFIG_PROVIDER=local 落 host(worker 本机、无隔离)、否则落
+    // in-process stub,且两种跑法的成功回执同形(status=completed,test [2753]§2 实测「在哪儿跑的」对外
+    // 零信息量)。操作员配了沙箱却在真机上跑 = P 类判据表的样板案,必须拒启点名,不静默降级。
+    // 语义边界:REMOTE_EXEC **未设**(或空串,env 管理器的显式「不选」形)不是降级,是文档化的部署姿态
+    // (local ⇒ host 默认,fleet ⇒ stub),照旧;拒启只咬「点了名却配不齐/认不出」。缺失点名要**准**——
+    // 只列缺的件,不列 lane 的全量需求(WORKFLOW_SIZE_GUIDELINE / MEMORY_SYNC_* 半配拒启同族先例)。
+    {
+        const lane = process.env.REMOTE_EXEC;
+        if (lane !== undefined && lane !== "") {
+            const REQUIRED_ENVS_BY_LANE = {
+                e2b: ["E2B_API_KEY"],
+                k8s: ["K8S_SANDBOX_IMAGE"],
+                ssh: ["SSH_HOST", "SSH_USER", "SSH_PRIVATE_KEY"],
+                adb: ["ADB_SERIAL"],
+                host: [],
+                "local-docker": ["DOCKER_IMAGE"],
+            };
+            const required = Object.hasOwn(REQUIRED_ENVS_BY_LANE, lane) ? REQUIRED_ENVS_BY_LANE[lane] : undefined;
+            if (required === undefined) {
+                throw new Error(`REMOTE_EXEC="${lane}" is not an execution lane — valid: e2b | k8s | ssh | adb | host | local-docker. ` +
+                    `An unrecognized value used to fall through to the host/in-process lane silently; refusing to start instead (#157).`);
+            }
+            const missing = required.filter((name) => !process.env[name]);
+            if (missing.length > 0) {
+                throw new Error(`REMOTE_EXEC=${lane} but required env ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} missing/empty — ` +
+                    `refusing to start rather than silently downgrading to the host/in-process lane (#157; unset REMOTE_EXEC if you meant no sandbox lane).`);
+            }
+        }
+    }
     return {
         remoteExec: process.env.REMOTE_EXEC === "e2b" && process.env.E2B_API_KEY
             ? {
@@ -1375,8 +1491,8 @@ const MODEL_PLANE_GROUP_KEYS = [
 const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
     "approvalHmacKeys", "durableApproval", "directApprovalDoor", "directDoorActive", "resourceSuspend",
-    "resourceSuspendTtlSec", "askQuestionEnabled", "toolApprovalEnabled", "mcpElicitation", "sensitiveWritePatterns",
-    "manualModeShellGate",
+    "resourceSuspendTtlSec", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "streamAskWindowMarginMs", "streamApproval", "mcpElicitation",
+    "sensitiveWritePatterns", "manualModeShellGate",
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",
@@ -1459,6 +1575,11 @@ export function attachConfigGroups(flat) {
     return flat;
 }
 export function loadConfig() {
+    // #157:落点清槽必须排在**第一条**语句 —— 比下面那组同类复位还早一格,因为 rejectRetiredEnvs 本身会抛,
+    // 而一轮抛出的 loadConfig 绝不能把**上一轮**成功解析的落点留在槽里被下一次排空读成本轮事实
+    // (交叉复审第二轮,2026-08-06)。下面三格同族收集器在这条最早拒启路径上仍有同形残留,那是既有面、
+    // 且都按 warn 排空,不在本件射程内。
+    EXEC_LANE_NOTICE = undefined;
     rejectRetiredEnvs(); // [2354] 退役 env 墓碑:在场即拒启带新名指引
     CONFIG_WARNINGS.length = 0; // repeated loadConfig() calls (test setup) must not accumulate stale warnings
     CONFIG_NOTICES.length = 0;
@@ -1528,6 +1649,18 @@ export function loadConfig() {
             throw new Error(`DIRECT_APPROVAL_DOOR=true but D-G anchors are missing: ${missing.join(", ")} — refusing to start a half-open direct door (design/80 D-G boot invariant)`);
         }
     }
+    // 🔴 boot invariant (#157-①, silent-downgrade-batch-20260805 普查候选 1/2): the BFF multi-tenant durable form
+    // (DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true, direct door OFF) had NO invariant — the D-G one above only
+    // binds when DIRECT_APPROVAL_DOOR=true. On that form the four READ surfaces in approvals-assistant.ts
+    // (GET /v1/approvals, /stream, /v1/assistant/inbox, /tasks) scope by the bare isOperator, whose empty-list
+    // "true-for-all" lets ANY authenticated tenant principal list/subscribe every other tenant's pending queue
+    // (redacted tool-input previews + decide-binding fields) and inspect arbitrary owners via ?owner. The WRITE
+    // surfaces (decide/preempt/resume/plan_review) already use explicitOperatorOk and were never exposed. The
+    // single-tenant legacy semantic (REQUIRE_PRINCIPAL unset — the shared service token IS the operator boundary)
+    // is deliberately preserved: only the multi-tenant form is a hole. Refuse to start it.
+    if (dgDurable && requirePrincipal && dgOperators.length === 0) {
+        throw new Error("DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true but OPERATOR_PRINCIPALS is empty — on a multi-tenant worker the empty operator set makes isOperator() true-for-all, so every authenticated tenant could read every other tenant's pending-approval queue (GET /v1/approvals & siblings). Set OPERATOR_PRINCIPALS, or unset REQUIRE_PRINCIPAL if this is a single-tenant deployment (#157-① boot invariant)");
+    }
     // 🔴 boot invariant (IMAGE-API-DESIGN.md §P2.4a): the bake door is build-host-RCE-capable, and isOperator([],p)
     // is true-for-all — so enabling bakes with an empty OPERATOR_PRINCIPALS = a WORLD-WRITABLE RCE door. Refuse to
     // start (never a half-open bake door). The explicit-operator gate in server.ts is the runtime twin of this.
@@ -1541,6 +1674,9 @@ export function loadConfig() {
     if (imageBakesEnabled && !Object.values(authTokens).includes(bakeRunnerPrincipal)) {
         throw new Error(`IMAGE_BAKES_ENABLED=true but no SERVICE_AUTH_TOKENS entry maps to the runner principal '${bakeRunnerPrincipal}' — the bake-runner authenticates by its credential (token-derived source), so a '<BAKE_RUNNER_TOKEN>=${bakeRunnerPrincipal}' SERVICE_AUTH_TOKENS entry is required or claim/ingest/heartbeat all 403 (IMAGE-API-DESIGN.md §P2.12 boot invariant)`);
     }
+    // #157 F 类观测:执行车道落点记账放在这里 —— 九域解析与上面全部跨域不变量都过了之后,即「这一轮
+    // 确实启得起来」才成立的位置(写在 REMOTE_EXEC 解析途中的话,后置拒启会留下一条没启起来的落点)。
+    EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec);
     // 平铺面**单点展开**九域产物(唯一存储处),再挂上九个组视图。组视图是对这同一个对象的取景器,
     // 不是第二份拷贝 —— 故 `config.limitsHttp.port === config.port` 恒成立,含热应用之后(见
     // attachConfigGroups / config-types.ts 分组段)。

package/dist/elicitation.d.ts

@@ -15,6 +15,10 @@ export interface ElicitationFrame {
     mode?: "form";
     /** "elicitation_complete" only: how it resolved. */
     action?: McpElicitResponse["action"];
+    /** Server-signed emit timestamp (additive, [2805]§五→[2806]). These side-frames are SERVER-minted — they have
+     *  no core-stream anchor, so no `eventId` (absence is honest, not an omission); this is the frame's own time
+     *  coordinate instead, same posture as the stream-approval frames' `serverNowMs`. */
+    serverNowMs?: number;
 }
 /** The per-run context `onElicit` recovers via ALS. `emit` delivers a frame to the run's live stream;
  *  `abortSignal` (the run's own cancel signal) lets a run-abort promptly cancel an elicitation parked awaiting a

package/dist/elicitation.js

@@ -27,6 +27,7 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7, delimitUntrusted } from "@sema-agent/core";
 import { redactSecrets, redactDeep } from "./trace/redact.js";
+import { recordFailOpen } from "./observability/fail-open.js";
 /** Size bounds on the UNTRUSTED server-controlled payload (the throttle bounds COUNT, these bound SIZE — an
  *  opted-in-but-hostile server otherwise amplifies a multi-MB prompt/schema into the durable log + SSE socket).
  *  The message is a human-facing prompt (a few KB is ample); a requestedSchema over the cap is dropped (the form
@@ -182,11 +183,13 @@ export class ElicitationCoordinator {
         // cursor (an invisible prompt that then TTL-declines). On a successful emit, charge the per-run-tree budget; a
         // FAILED emit declines (nobody can answer) and must NOT burn maxTotal / the per-server interval.
         try {
-            await ctx.emit({ type: "elicitation", elicitationId: id, mcpServerName: req.server, message, ...(requestedSchema !== undefined ? { requestedSchema } : {}), mode: "form" });
+            await ctx.emit({ type: "elicitation", elicitationId: id, mcpServerName: req.server, message, ...(requestedSchema !== undefined ? { requestedSchema } : {}), mode: "form", serverNowMs: this.now() });
             rc.total += 1;
             rc.lastByServer.set(req.server, t);
         }
         catch {
+            // #157:投递失败 ⇒ decline。方向已是 fail-closed(问不到人就是拒),缺的只是留痕。
+            recordFailOpen("server.elicitation.open-frame-undelivered", `elicitation=${id} server=${req.server}`);
             settle({ action: "decline" }); // inflight rolled back in settle
         }
         const answer = await answerP;
@@ -194,8 +197,9 @@ export class ElicitationCoordinator {
         // returning the answer to core (which replies to the MCP server on the still-open connection). Best-effort +
         // ordering-uncritical: the shell already has the answer via respond; a late/lost dismiss is cosmetic.
         void Promise.resolve()
-            .then(() => ctx.emit({ type: "elicitation_complete", elicitationId: id, mcpServerName: req.server, action: answer.action }))
-            .catch(() => undefined);
+            .then(() => ctx.emit({ type: "elicitation_complete", elicitationId: id, mcpServerName: req.server, action: answer.action, serverNowMs: this.now() }))
+            // #157:F 类兜底,与 question.ts 的孪生面同形同 tag 形(丢收尾渲染,不丢答案)。
+            .catch(() => recordFailOpen("server.elicitation.complete-breadcrumb-dropped", `elicitation=${id}`));
         return answer;
     };
     /** `POST /v1/elicitations/:id/respond` — resolve a parked elicitation with the shell's answer. Owner-gated with a

package/dist/finance/cost-taxonomy.d.ts

@@ -0,0 +1,34 @@
+export interface InfraCostRates {
+    toolCallMicroUsd: number;
+    sandboxSecMicroUsd: number;
+    egressGbMicroUsd: number;
+}
+export interface InfraUsage {
+    toolCalls: number;
+    sandboxWalltimeMs: number;
+    egressBytes: number;
+}
+export interface InfraCostBreakdown {
+    toolCallMicroUsd: number;
+    sandboxWalltimeMicroUsd: number;
+    egressMicroUsd: number;
+    totalMicroUsd: number;
+}
+export interface LlmCostBreakdown {
+    llmRootMicroUsd: number;
+    nestedSubagentMicroUsd: number;
+    memoryConsolidationMicroUsd: number;
+    compactionMicroUsd: number;
+}
+export interface SupervisorCostBreakdown {
+    llm: LlmCostBreakdown | null;
+    infra: InfraCostBreakdown;
+    totalMicroUsd: number;
+}
+export declare function infraCost(usage: InfraUsage, rates: InfraCostRates): InfraCostBreakdown;
+export declare function composeSupervisorCost(llm: LlmCostBreakdown | null, llmTotalMicroUsd: number, infra: InfraCostBreakdown): SupervisorCostBreakdown;
+export declare function hasInfraPricing(r: InfraCostRates): boolean;
+export declare function infraUsageFromEvents(events: ReadonlyArray<{
+    type?: string;
+}>, runDurationMs: number): InfraUsage;
+//# sourceMappingURL=cost-taxonomy.d.ts.map

package/dist/finance/cost-taxonomy.js

@@ -0,0 +1,26 @@
+const nonNeg = (n) => (Number.isFinite(n) && n > 0 ? n : 0);
+export function infraCost(usage, rates) {
+    const toolCallMicroUsd = nonNeg(usage.toolCalls) * nonNeg(rates.toolCallMicroUsd);
+    const sandboxWalltimeMicroUsd = (nonNeg(usage.sandboxWalltimeMs) / 1000) * nonNeg(rates.sandboxSecMicroUsd);
+    const egressMicroUsd = (nonNeg(usage.egressBytes) / 1_000_000_000) * nonNeg(rates.egressGbMicroUsd);
+    return {
+        toolCallMicroUsd,
+        sandboxWalltimeMicroUsd,
+        egressMicroUsd,
+        totalMicroUsd: toolCallMicroUsd + sandboxWalltimeMicroUsd + egressMicroUsd,
+    };
+}
+export function composeSupervisorCost(llm, llmTotalMicroUsd, infra) {
+    return { llm, infra, totalMicroUsd: nonNeg(llmTotalMicroUsd) + infra.totalMicroUsd };
+}
+export function hasInfraPricing(r) {
+    return r.toolCallMicroUsd > 0 || r.sandboxSecMicroUsd > 0 || r.egressGbMicroUsd > 0;
+}
+export function infraUsageFromEvents(events, runDurationMs) {
+    return {
+        toolCalls: events.reduce((n, e) => (e.type === "tool_start" ? n + 1 : n), 0),
+        sandboxWalltimeMs: nonNeg(runDurationMs),
+        egressBytes: 0,
+    };
+}
+//# sourceMappingURL=cost-taxonomy.js.map

package/dist/hooks/hook-runner.js

@@ -706,6 +706,10 @@ export function createTaskHooks(config, ctx) {
             let currentInput = input;
             let rewritten = false;
             let asked;
+            // #157 fail-open 治理(P 类,tag `server.hooks.pretooluse-unknown-permission-word`):本轮见过
+            // 词表外的 `permissionDecision`。安全域闭集词表的 miss 不是"没意见"——钩子作者**表过态**,只是
+            // 用了我们不认识的词;把它折成放行等于替他改判。置位后禁止本轮铸 `action:"allow"`(见末尾折叠)。
+            let unknownDecision = false;
             const contexts = [];
             const deadlineAt = Date.now() + MAX_HOOK_EVENT_TOTAL_SECONDS * 1000; // 跨全部组的事件级预算
             // 逐条串行(deny 立即短路;updatedInput 串进后续条目 payload——确定性优先,CC 的并行聚合语义
@@ -771,6 +775,18 @@ export function createTaskHooks(config, ctx) {
                                 rewritten = true;
                             }
                         }
+                        else if (decision !== "deny" && decision !== "ask") {
+                            // 闭集 miss(拼错大小写的 deny / 自造词 / 非字符串 / null)。该条目的裁决**整条不采信**:
+                            // 它的 updatedInput 也不进串(上面的 if 已排除),并置位禁 allow。CC 的 `allow`/`deny`/
+                            // `ask` 三词是唯一词表;新词入表须同时进这里,否则它在本仓的语义就是"不采信"。
+                            unknownDecision = true;
+                            ctx.logger.warn("hook_permission_decision_unknown", {
+                                event: "PreToolUse",
+                                decision: clip(typeof decision === "string" ? decision : typeof decision, 200),
+                                tool: toolName,
+                                effect: "hook ruling not honored (closed word set is allow|deny|ask); this call falls back to the engine gate",
+                            });
+                        }
                     }
                 }
             }
@@ -785,6 +801,22 @@ export function createTaskHooks(config, ctx) {
                     ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}),
                 };
             }
+            if (unknownDecision) {
+                // #157:本轮有一条**不采信**的裁决 ⇒ 一律折 `ask`(人在环)。两条都不行,各有其害:
+                //  · `allow` —— 显式放行短路,引擎门不再裁决,等于替钩子作者把 DENY 改判成放行;
+                //  · `undefined`(无裁决)—— 看着中立,其实**不是** fail-closed(codex 复审 HIGH,2026-08-07):
+                //    引擎拿到无裁决就走普通门,而 bypassPermissions / acceptEdits 档下普通门就是放行,
+                //    钩子作者写的 DENY 照样跑。词表 miss 的语义是「保护型判词坏了」而不是「钩子没表态」。
+                // 已有改写则随 `ask` 投递:改写通常正是 redact/clamp,丢了它 approve 后执行的是【原始】args
+                // —— `ask` 是唯一既 fail-closed 又能带 updatedInput 的裁决形。不采信的那条自己的改写不在其中
+                // (上面的 if 已把它挡在串外),否则一个坏判词就是一条免审的 args 改写通道。
+                return {
+                    action: "ask",
+                    message: "a PreToolUse hook returned an unrecognized permissionDecision — approval required",
+                    ...(rewritten ? { updatedInput: currentInput } : {}),
+                    ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}),
+                };
+            }
             if (rewritten || contexts.length > 0) {
                 return {
                     action: "allow",

package/dist/http/routes/capabilities.js

@@ -2,6 +2,7 @@ import { DEFAULT_EFFORT_LEVELS } from "@sema-agent/core";
 import { cwdHonored } from "../../task-cwd.js";
 import { mcpInjectionHonored } from "../../task-mcp.js";
 import { sendJson, sendError } from "../send.js";
+import { resolveStreamApprovalGate } from "../../tool-approval.js";
 export async function handleCapabilities(req, res, url, ctx) {
     const miss = { fell: false };
     await handleCapabilitiesBody(req, res, url, ctx, miss);
@@ -211,6 +212,19 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             // exists, and only fail-closed denies without one ([819]⑤). The durable-approval leg (checkpoint park +
             // /decide) is independent of this.
             toolApproval: Boolean(deps.toolApproval),
+            // #151 车3 刀 3b(设计稿 §2.4):design/172 **流内审批协议**(`approval_request` 呈卡帧 + 开流
+            // preamble 对账基准 + durable 回决端点)。判据走**单一谓词** `resolveStreamApprovalGate` —— 与协调器
+            // 的 askStore 注入、与 `POST /v1/tasks/:taskId/asks/:askId/decision` 的 501 门同一个符号,所以
+            // 「这里说 true」⟺「协议真的在场」是结构成立的,壳不必 trial-by-帧(诚实缺席纪律,同上文各格)。
+            // 五个合取项里最容易被忽略的两条:**账必须是持久的**(local 的 InMemory 形重启即丢已接受的决议)
+            // 与 **park 设施必须在场**(缺席时窗到期没有降级目的地,结局是 core fail-closed deny —— 比现行
+            // 5min 活卡更差,所以协议诚实地不上场、活卡腿逐字保留)。
+            streamApproval: resolveStreamApprovalGate({
+                toolApprovalEnabled: Boolean(deps.toolApproval),
+                streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
+                backend: deps.backend,
+                parkFacility: deps.checkpointStore !== undefined,
+            }).active,
             // [1469] POST /v1/side-query(core 1.361 Runner.sideQuery 包装):一次性 brain 路由问答,无 session
             // 副作用。恒可用(runner 自带)——探测位供壳判「引擎腿在」而非 trial-by-404。
             sideQuery: true,