@sema-agent/server 7.4.0 → 7.6.0

package/dist/task-settings.d.ts

@@ -192,16 +192,10 @@ export interface FsWriteGateWiring {
      *  allow with decisionReason "rule", a THROWN probe ⇒ not exempt = fail-closed to ask). Same canonical
      *  toolName key space as the ask-policy layer's exemption probe — ONE grant serves both layers; the gate-level
      *  check is what makes "allow all session" bite SAME-TURN for the parent and inherited child tasks (the ask
-     *  path is never re-entered). (codex M1 的边界注记已闭合:core 1.295 起本仓在 gate 腿上组合
-     *  createSensitivePathPolicy —— 见 `sensitivePatterns`,deny 在 combinePolicies 折叠里恒胜,豁免/acceptDirs
-     *  越不过它。) */
+     *  path is never re-entered). (codex M1 的边界注记:sensitive-path DENY 腿与本探针的「豁免越不过 deny」
+     *  保证仍成立——但那条腿已随 #177 搬到 governance 层,deny-wins 是 tightenTaskSpec 折叠给的,不再依赖
+     *  本 wiring 的组合点。) */
     isExempt?: (toolName: string, canonicalPath: string) => boolean | Promise<boolean>;
-    /** ③ (core 1.295): the sensitive-path write DENY set composed onto the fs-write gate leg —
-     *  `createSensitivePathPolicy({env, patterns, rootPath: cwd})`, deny-wins in the SAME combinePolicies fold, so a
-     *  session exemption (isExempt) or an acceptEdits auto-allow can never cross it (the 1.199-batch documented gap,
-     *  now closed). Source = config `SENSITIVE_WRITE_PATTERNS` (unset ⇒ core RECOMMENDED_SENSITIVE_PATTERNS; the
-     *  set curation is core's — the server passes through). Absent/empty ⇒ no sensitive policy (pre-1.295 shape). */
-    sensitivePatterns?: string[];
 }
 export declare function deriveSettingsPolicy(settings: ParsedTaskSettings, gate?: FsWriteGateWiring, workflowGate?: WorkflowGateWiring): {
     toolPolicy?: ToolPolicy;

package/dist/task-settings.js

@@ -35,8 +35,8 @@
  *  - (`hooks` NO LONGER deferred either — 轴B #2 注释保鲜:applied 形已接线(本文件 hooks 分片 +
  *    main.ts 单用户闸),仅 malformed 才报 deferred;旧「需要 remote hook-runner」是接线前拍照。)
  */
-import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createSensitivePathPolicy, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, } from "@sema-agent/core";
-import { findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
+import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, } from "@sema-agent/core";
+import { findCcRuleFormNames, findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 /**
  * R4: coerce a raw top-level `body.permissionMode` (the LIGHT per-turn wire — the shell sends the
@@ -367,9 +367,12 @@ function createWorkflowPlanDenyPolicy() {
  * silent on this leg. Throwing here surfaces as a 422 at the HTTP boundary (resolve-spec already wraps every
  * throw out of `applyTaskSettings`), i.e. the same fail-loud posture the other two legs have.
  *
- * `allow` is deliberately NOT judged: it is a WHITELIST — a name that matches nothing leaves the allowlist
- * effectively empty, so every tool falls to "not in the allowlist" and is DENIED. That fails closed and is
- * immediately visible to the caller, which is a different (and acceptable) failure mode from a silent hole.
+ * `allow` is deliberately NOT judged by the GENERAL arm: it is a WHITELIST — a name that matches nothing leaves
+ * the allowlist effectively empty, so every tool falls to "not in the allowlist" and is DENIED. That fails closed
+ * and is immediately visible to the caller, which is a different (and acceptable) failure mode from a silent hole.
+ * The ONE exception is the CC-rule-form arm ({@link findCcRuleFormNames}, #186): `allow: ["Bash(ps:*)"]` is the
+ * shape a CC user writes to get FEWER prompts and it silently costs them Bash entirely — a spelling-family error,
+ * not a typo, so it is refused on all three lists. See the config.ts docblock for the two knobs it points at.
  */
 function rejectUnmatchableSettingsNames(perms) {
     for (const [field, names] of [["permissions.ask", perms.ask], ["permissions.deny", perms.deny]]) {
@@ -379,6 +382,11 @@ function rejectUnmatchableSettingsNames(perms) {
         if (bad.length > 0)
             throw new Error(formatUnmatchableToolNames(field, bad));
     }
+    if (perms.allow) {
+        const bad = findCcRuleFormNames(perms.allow);
+        if (bad.length > 0)
+            throw new Error(formatUnmatchableToolNames("permissions.allow", bad));
+    }
 }
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
     const perms = settings.permissions;
@@ -398,11 +406,8 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
     // the given env, only ever allow/ask). undefined without wiring (see FsWriteGateWiring). #156/#165: the sandbox
     // lanes supply wiring too — same factory, a deferred real-env proxy and no cwd; the shape difference lives
     // entirely in what `resolve-spec.ts` puts in the wiring, not in a second code path here.
-    // ③ (core 1.295): the sensitive-path DENY policy (patterns from the wiring — config SENSITIVE_WRITE_PATTERNS,
-    // default = core's RECOMMENDED set) composes into the SAME fold, deny-wins — core semantics deny/"safety", so
-    // neither the gate's own allow legs (exemptDirs/acceptDirs/isExempt session exemption) nor a settings allow can
-    // cross it (the 1.199-batch gap: an exempted tool could write .git/hooks — closed here). Same env/rootPath as
-    // the gate (the fs the hands really write; symlink canonicalization inside the policy, dist-read).
+    // (③ sensitive-path DENY 已随 #177 搬 governance 层——见 FsWriteGateWiring 尾注。deny-wins 由
+    //  tightenTaskSpec 折叠保证:豁免/acceptDirs/settings allow 仍然越不过部署 DENY 基线。)
     const fsWriteGate = (acceptCwd) => {
         if (!gate)
             return undefined;
@@ -422,9 +427,7 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
         // NotebookEdit 时 notebook_path 恒先(诱饵 file_path 失效),其余工具 file_path 先(反向诱饵也封);均 dist
         // 亲读。回归锚保留在 test/task-settings.test.ts(NotebookEdit deny + 双向诱饵),现在锁的是 core 行为经
         // 我方折叠——core 若回退,锚变红。
-        return gate.sensitivePatterns && gate.sensitivePatterns.length > 0
-            ? combinePolicies(createSensitivePathPolicy({ env: gate.env, patterns: gate.sensitivePatterns, ...(gate.cwd !== undefined ? { rootPath: gate.cwd } : {}) }), gatePolicy)
-            : gatePolicy;
+        return gatePolicy;
     };
     const compose = (...extra) => {
         const all = [...policies, ...extra.filter((p) => p !== undefined)];

package/dist/tool-approval.d.ts

@@ -1,6 +1,7 @@
 import { type AskRequest, type AskOutcome } from "@sema-agent/core";
 import { type ApprovalRequestFrame, type ApprovalRevokeFrame } from "./approval-card.js";
 import type { ApprovalAskStore } from "./plugins/approval-ask-store-sql.js";
+import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 /** A live approval frame delivered to whoever tails this run's stream. `type` IS the SSE event name (named-event
  *  convention, same as question). The shell renders `tool_approval` as the CC three-choice card and dismisses on
  *  `tool_approval_complete`. */
@@ -37,6 +38,19 @@ export interface ToolApprovalFrame {
         agentName?: string;
     };
     message?: string;
+    /**
+     * [2942]/[2943] **ADDITIVE**,`"tool_approval"` only —— `true` ⇔ 这只 ask 的门来自**运维治理层**
+     * (`AUTONOMY` / `commandPolicy` / `MANUAL_MODE_SHELL_GATE` / `SENSITIVE_WRITE_PATTERNS` 合成的那条
+     * policy,`applyRuntimeGovernance`),而不是模型默认门或客户端表态。壳据此渲染「治理强制」徽标,回答
+     * [3031]#1/[3038] 实证的那个 UX 缺口:「我都开 bypassPermissions 了为什么还在问」。
+     *
+     * 🔴 **缺席 ≠ `false`**:本键**只在为真时在场**,缺席的含义是「没有治理来源的证据」——既覆盖真正的
+     * 非治理 ask(如 `APPROVAL_REQUIRE` 显式列名),也覆盖判据够不着的形(如治理层 shellGate 停在
+     * `"classify"` 档时,一次 shell ask 究竟出自分类器还是别的门,在 `AskRequest` 上无从分辨)。
+     * 消费端**禁**把缺席读成「这不是治理门」。判定缝的真形与为什么不能走 `decisionReason`:
+     * `governance-ask-marks.ts` 顶注。
+     */
+    governanceForced?: true;
     /** "tool_approval" only: the tool call's args, secret-redacted, UNTRUSTED-for-display. Absent (with
      *  `argsOmitted: true`) when over the byte cap or unserializable. */
     args?: unknown;
@@ -61,8 +75,10 @@ export interface ToolApprovalRunContext {
      * 协议**(`approval_request` 族)的一员,消费方是新壳 —— 分口投递是诚实的分层,装配点(车3 3b /
      * 车4 域)可以与 `approval_request` 的发射点**同批**接上。
      *
-     * 缺席 ⇒ 本连接不收撤卡帧(与 `approval_request` 今天尚未接上发射点同栏);壳侧的结构补偿恒是重连
-     * preamble 的全量对账基准。
+     * 缺席 ⇒ 本连接不收撤卡帧;壳侧的结构补偿恒是重连 preamble 的全量对账基准。
+     * (原注拿「`approval_request` 今天也还没接上发射点」作同栏类比 —— 那个类比已被 60846e6 证伪:呈卡口
+     * 三腿都接上了,而本钩子至今只有 sync 腿接 live 口。两者不再同栏,类比句因此删掉,别再据它推断
+     * 「两族都还没接线」。)
      */
     emitRevoke?: (frame: ApprovalRevokeFrame) => void | Promise<void>;
     /**
@@ -115,7 +131,8 @@ export declare function parseToolApprovalResponse(body: unknown): {
  *
  * 五个合取项,缺一即不上场(每一项的缺席都有它自己的 `reason`,供启动期 info 与诊断分辨):
  *  1. `toolApprovalEnabled` —— 连活卡腿都没有,谈不上流内协议;
- *  2. `streamApprovalEnabled` —— 协议总开关(默认 OFF);
+ *  2. `streamApprovalEnabled` —— 协议总开关(`STREAM_APPROVAL_ENABLED`,树上已**默认 ON**;显式 `false`
+ *     是唯一干净还原键。默认极性与版本坐标的属主口径见 `config.ts` 的 `streamApprovalConfig()` 头注);
  *  3. `backend` 在场 —— env-only worker 没有 `StoreBackend` 本体;
  *  4. **账必须是持久的**(`kind !== "local"`)—— InMemory 形重启即丢**已接受的决议**,那与「对账便利
  *     丢失」不是一个量级(§2.2(b));File 形 ask 店落地后这一项自然翻真;
@@ -135,9 +152,13 @@ export type StreamApprovalGate = {
  *  协调器的家,不该为一个布尔判据把整棵 store 依赖树拖进类型面。 */
 export interface StreamApprovalGateInput {
     toolApprovalEnabled: boolean;
-    /** 协议总开关。⚠️ 调用点一律写 `config.streamApproval?.enabled === true` —— **可选链是 fail-closed 的**:
-     *  配置段缺席只可能意味着「这个部署没有配它」,而协议的默认就是 OFF。真实 boot 恒有此段
-     *  (`config.ts` 无条件铸 + 白名单门盯着),`?.` 服务的是那些只填被测路由用得到的键的 stub-harness。 */
+    /** 协议总开关。⚠️ 调用点一律写 `config.streamApproval?.enabled === true` —— **可选链的缺席臂折算
+     *  false**(段整段缺席 ⇒ 协议不上场)。
+     *  🔴 当年这条写的理由是「缺席折算值 == 产品默认(那时是 OFF)」,所以 `?.` 纯粹无副作用;产品默认
+     *  现已翻 ON(`config.ts` 的 `streamApprovalConfig()`),两者**不再相等**,那条理由作废。现行的
+     *  (更弱也更诚实的)判据:真实 boot 恒有此段(`config.ts` 无条件铸 + 白名单门盯着),`?.` 服务的只是
+     *  那些只填被测路由用得到的键的 stub-harness,而一个没填这个段的 harness 要的必然是「别上场」。
+     *  **不要**照「缺席 = 与产品默认同」去推理。 */
     streamApprovalEnabled: boolean;
     backend: {
         readonly kind: "mysql" | "pg" | "local";
@@ -276,12 +297,18 @@ export declare class ToolApprovalCoordinator {
     /** #151 车2(D5 一次性 warn 节流):同实例只报第一次,后续只计数(避免 store 抖动期间刷屏)。 */
     private storeErrorWarned;
     private storeErrorTally;
+    /** [2942]/[2943] `governanceForced` 的**读侧**表(写侧 = runtime-governance 的两只观察器)。
+     *  缺席(生产形)⇒ 每条 run 腿由 {@link runWithContext} 现铸一张、经 ALS 与写侧共享;在场 ⇒ 测试注入的
+     *  固定表(此时不进 ALS 作用域,读写都走这一张)。作用域理由见 `governance-ask-marks.ts` 顶注。 */
+    private readonly governanceAskMarks;
     constructor(opts?: {
         ttlMs?: number;
         askStore?: ApprovalAskStore;
         windowMarginMs?: number;
         admitMaxPerTask?: number;
         admitMaxPerOwner?: number;
+        /** 缺省 = 进程级单表(写侧默认同一张)。注入口只为测试与将来的多实例形。 */
+        governanceAskMarks?: GovernanceAskMarks;
     });
     /**
      * #151 车3 刀 3b —— design/172 §3.3 / 设计稿 §0 X-2 的**写侧准入门**。

package/dist/tool-approval.js

@@ -25,8 +25,11 @@
  * grant. This is the cheapest mid-task implementation; a mode SWITCH (default → acceptEdits) still goes through the
  * shell's intent on the next task ([820] table).
  *
- * 🔒 FAIL-CLOSED everywhere (the inverse of question's headless default — an unanswered QUESTION lets the model
- * proceed; an unanswered APPROVAL must NOT let the write proceed): TTL expiry ⇒ false; run abort / client
+ * 🔒 FAIL-CLOSED everywhere (the inverse of the question lane — an unanswered QUESTION never blocks the run: since
+ * #166 the coordinator reports `unavailable` and CORE decides the landing, which depends on WHEN the human became
+ * unreachable — at policy time the durable gate says `ask` and the leg parks; once the tool is already running core is
+ * past `suspendAsk`, so it continues on `declined_unavailable`; an unanswered APPROVAL must NOT let the write
+ * proceed): TTL expiry ⇒ false; run abort / client
  * disconnect ⇒ false. Since [879] G1 (core 1.295 OnAsk 三值化) the "no reachable human" class returns
  * "unavailable" instead of false — no ALS context AND no bound-closure broker hit(1.258 起 bg/嵌套子代经
  * spec.onAsk 的 bound 闭包 + streams broker 直达宿主活流,「无 ctx」只剩 durable-submit/headless resume
@@ -46,14 +49,21 @@ import { redactDeep, redactSecrets } from "./trace/redact.js";
 import { createLogger } from "./observability/logger.js";
 import { deriveAskId, deriveBatchId } from "./approval-ask-machine.js";
 import { ApprovalCardEnvelopeSchema, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, } from "./approval-card.js";
+import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 /** #151 车2:本模块自有的日志出口——同 config-provider.ts/runtime-caps-resolver.ts 先例(协调器不走
  *  DI logger,构造签名是设计定稿钉死的三键 options bag,加第四个 logger 键属于重议已裁事项）。仅用于
  *  D5 的一次性 store-故障 warn。 */
 const defaultLogger = createLogger();
 /** Size bound on the redacted args payload in a `tool_approval` frame (parity with question's MAX_QUESTIONS_BYTES).
- *  Over the cap ⇒ the frame still goes out WITHOUT args (`argsOmitted: true`) — unlike a question (undisplayable ⇒
- *  headless default is safe), an approval must still reach the human: toolName+message suffice to decide, and the
- *  fail-safe decision on blind args is the human's No. */
+ *  Over the cap ⇒ the frame still goes out WITHOUT args (`argsOmitted: true`). The sibling lane makes the OPPOSITE
+ *  call and that asymmetry is deliberate: an over-cap question is DROPPED and the ask reports `unavailable`
+ *  (`question.ts` `MAX_QUESTIONS_BYTES`; since #166 that is an honest "nobody answered" and CORE picks the landing —
+ *  here the tool is already running, so core is past `suspendAsk` and continues on `declined_unavailable` rather than
+ *  parking). Dropping an approval would land it on
+ *  this module's "no reachable human" class instead — `"unavailable"`, which durable-parks where a checkpoint store
+ *  exists and fail-closed DENIES where it does not (see the module header). Both of those postpone or refuse the
+ *  write; keeping the card on the wire without args is the only option that still buys an IMMEDIATE human decision —
+ *  toolName+message suffice to decide, and the fail-safe decision on blind args is the human's No. */
 const MAX_APPROVAL_ARGS_BYTES = 16384;
 /** How long an unanswered approval waits before it DENIES (fail-closed — the human walked away; don't hold core). */
 const DEFAULT_APPROVAL_TTL_MS = 5 * 60_000;
@@ -325,7 +335,12 @@ export class ToolApprovalCoordinator {
     /** #151 车2(D5 一次性 warn 节流):同实例只报第一次,后续只计数(避免 store 抖动期间刷屏)。 */
     storeErrorWarned = false;
     storeErrorTally = 0;
+    /** [2942]/[2943] `governanceForced` 的**读侧**表(写侧 = runtime-governance 的两只观察器)。
+     *  缺席(生产形)⇒ 每条 run 腿由 {@link runWithContext} 现铸一张、经 ALS 与写侧共享;在场 ⇒ 测试注入的
+     *  固定表(此时不进 ALS 作用域,读写都走这一张)。作用域理由见 `governance-ask-marks.ts` 顶注。 */
+    governanceAskMarks;
     constructor(opts) {
+        this.governanceAskMarks = opts?.governanceAskMarks;
         this.ttlMs = opts?.ttlMs ?? DEFAULT_APPROVAL_TTL_MS;
         this.askStore = opts?.askStore;
         this.windowMarginMs = opts?.windowMarginMs ?? DEFAULT_WINDOW_MARGIN_MS;
@@ -562,7 +577,13 @@ export class ToolApprovalCoordinator {
         }
         const liveSet = set;
         liveSet.add(ctx);
-        return this.als.run(ctx, async () => {
+        // [2942]/[2943](codex round3/round5 两轮的修形):**写侧**的治理标作用域与审批 ctx 同拍进出,分格键
+        // 就是上面这把 broker `key` —— 读侧(askBroadcast)按**出处**显式算出同一把,于是委派/长命 bg 子代的
+        // ask 即便在另一条腿的上下文里发出也查得到自己的标(round5 的红先用例)。分格本身封的是 round3:
+        // `toolCallId` 是提供方给的、并非全局唯一,不分格会跨任务/跨租户串味(理由全文见 governance-ask-marks.ts)。
+        // 注入了固定表的实例(测试形)不再进作用域:读写都走那一张,行为与注入前逐字一致。
+        const enter = (body) => (this.governanceAskMarks ? body() : runWithGovernanceAskScope(key, body));
+        return enter(() => this.als.run(ctx, async () => {
             try {
                 return await fn();
             }
@@ -580,7 +601,7 @@ export class ToolApprovalCoordinator {
                         p.onTargetGone?.(ctx);
                 }
             }
-        });
+        }));
     }
     /** 测试/可观测性钩子:该 (owner, session/taskId) broker key 下当前活跃连接数——断言多连接注册/清扫
      *  行为时用,免得伸手进私有内部状态。 */
@@ -608,6 +629,12 @@ export class ToolApprovalCoordinator {
      *  emit 时经 broker 取该 (owner, session) 的「当前」活跃流(宿主重连/续聊的新 SSE 自动接卡;
      *  internalsSnapshot 冻结的闭包因此永不携死流)。查无活流 = "unavailable"(G1 回路:durable 部署
      *  park;inherited plain-ask 的 park 回路 = core RB-39①,落地前该臂 = deny,与 1.257 前行为一致)。 */
+    /*  [2942]/[2943] 与本闭包的关系(codex round4/round5 两轮追出来的形):本闭包**铸于**
+     *  `runWithContext` 之前(装配点 routes/tasks.ts 就是这个顺序),而委派/长命 bg 子代经 core 继承链拿到它
+     *  之后,可能在**宿主腿早已退场**、甚至任何审批作用域之外的上下文里把 ask 发出来。治理来源标因此
+     *  **不读环境**:`askBroadcast` 按 `identity`(经 `origin`/`primary`)显式算出与写侧同一把 broker key 去查
+     *  ——「出处决定判定,投递到哪条连接不参与」,与 {@link AskOriginIdentity} 顶注同源。两条腿的钉见
+     *  test/governance-forced-signal.test.ts(「长命 bg 子代形」与「脱钩定时器形」,改形前后者是红的)。 */
     boundAsk = (identity) => {
         return (req, signal) => {
             const set = this.streams.get(this.streamKey(identity.owner, identity.sessionId, identity.taskId));
@@ -694,6 +721,11 @@ export class ToolApprovalCoordinator {
                 }
                 : {}),
             message: typeof req.message === "string" ? redactDeep(req.message) : "",
+            // [2942]/[2943]:治理来源标(additive,只在为真时在场——缺席绝不编 false,见字段顶注)。
+            // 读的是**非消费式** peek:同一 toolCallId 的重播/failover 再入必须拿到同一份判定。
+            ...((this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(primary.owner, primary.sessionId, origin.taskId))).isMarked(req.toolCallId)
+                ? { governanceForced: true }
+                : {}),
             ...(bounded.omitted ? { argsOmitted: true } : { args: bounded.args }),
         };
         // #151 车2(design/172 §3.3 D3 窗长三元):有效窗——legDeadlineMonotonic 缺席时退化成 ttlMs(D1 零
@@ -732,7 +764,8 @@ export class ToolApprovalCoordinator {
         // R4-1 的三件套(见下方 ensureAsk 调用点注):迟到落盘的行 id / 本地是否已放弃 / 放弃时的收尾动作。
         let lateEnsuredAskId;
         let abandonedEnsure = false;
-        /** 本次 `ensureAsk` 传给店里的 `createdAtMs` —— 兼作**这次插入的归属凭据**(R2-2,见 onLateSuccess）。 */
+        /** 本次 `ensureAsk` 传给店里的 `createdAtMs`(纯时间戳;归属判别已改由店给的 `inserted` 位回答,
+         *  见 `EnsureAskResult` 顶注与下方 onLateSuccess）。 */
         const attemptCreatedAtMs = Date.now();
         const voidAbandonedRow = (orphanAskId) => {
             const store = this.askStore;
@@ -788,15 +821,26 @@ export class ToolApprovalCoordinator {
                     expiresAtMs,
                     createdAtMs: attemptCreatedAtMs,
                 }), "ensureAsk", DURABLE_CALL_TIMEOUT_MS, (late) => {
-                    // 🔴 codex 交叉复审 round2 R2-2(2026-08-06 真 finding):`ensureAsk` 是**幂等 upsert**,它迟到
-                    // 返回的那一行可能根本不是本次插的 —— 而是一条**早已存在、且正被另一次调用持有**的行(askId 是
-                    // 确定性派生,两次并发调用天然指向同一行)。旧形把任何 STREAM_PENDING 结果都当成「本次留下的
-                    // 孤儿」去收 VOID,于是本次超时放弃时会把**别人正在等的那张活卡**作废掉:真属主的 decideAsk
-                    // 随后干净地输,人的批准被吞成拒绝/延迟收敛。
-                    // 归属判据用现成数据:`createdAtMs` 是**插入者**写下的值,幂等命中时返回的是**先到者**的值。
-                    // 相等 ⇒ 这行是本次插的(才轮得到本次收尾);不等 ⇒ 幂等命中别人的行,一个字都不许动。
-                    // (残留:同一毫秒内的两次并发插入无法区分 —— ms 粒度的窄面,记在汇报存疑单。)
-                    lateEnsuredAskId = late.state === "STREAM_PENDING" && late.createdAtMs === attemptCreatedAtMs ? late.askId : undefined;
+                    // 🔴 codex 交叉复审 round2 R2-2(2026-08-06 真 finding)+ #168 件2 根治:`ensureAsk` 是**幂等
+                    // upsert**,它迟到返回的那一行可能根本不是本次插的 —— 而是一条**早已存在、且正被另一次调用
+                    // 持有**的行(askId 是确定性派生,两次并发调用天然指向同一行)。把任何 STREAM_PENDING 结果都
+                    // 当成「本次留下的孤儿」去收 VOID,会在本次超时放弃时把**别人正在等的那张活卡**作废掉:真属主
+                    // 的 decideAsk 随后干净地输,人的批准被吞成拒绝/延迟收敛。
+                    // 归属判据 = 店给的 `inserted` 位(引擎报的 affected 行数,`EnsureAskResult` 顶注)。R2-2 首修
+                    // 用的 `createdAtMs === attemptCreatedAtMs` 是**猜**,在同一毫秒的两次并发插入上会给假阳性
+                    // (那条残余随本件销账);`inserted` 是引擎对同一个问题的权威回答,严格窄于旧判据。
+                    // `state` 复核仍留:行是本次插的,不代表此刻还没人接手(别的副本可能已经在驱动它)。
+                    //
+                    // 🔴 **残余,登记而不假称已解**(codex 交叉复审 2026-08-07 [high] 二,验真;**先存**,本批只把它
+                    // 收窄没有扩大):`inserted` 回答的是「谁插的」,不是「此刻谁在驱动」。极窄的一支仍会伤人 ——
+                    // 本次插入**已提交**、提交后那次回读慢到超时、随后**每一次**复核读也全失败(店严重退化,才会走
+                    // `indeterminate` 臂),而这期间另一个副本幂等命中这条 STREAM_PENDING 行并开始真驱动它;此时
+                    // 迟到结果带着 `inserted: true` 回来,会把别人正在等的卡收成 VOID。
+                    // 旧的 `createdAtMs` 判据在同一支上同样会 VOID(那是本次自己写的时间戳)⇒ 本批不是引入方,是
+                    // 严格缩小了误伤集合(幂等命中的行从此一个字都不碰)。
+                    // 这条残余与 R4-1 的取舍是同一枚硬币:不收 = 留一条无属主的行被孤儿腿 park 出**幻影 gate**。
+                    // 真解 = 给行一个 attempt 级的属主租约(新列 + CAS 带租约),属协议改动,开题上报,不在本批。
+                    lateEnsuredAskId = late.inserted && late.row.state === "STREAM_PENDING" ? late.row.askId : undefined;
                     if (abandonedEnsure && lateEnsuredAskId !== undefined)
                         voidAbandonedRow(lateEnsuredAskId);
                 });
@@ -808,9 +852,9 @@ export class ToolApprovalCoordinator {
                 // 是**过去**某次早已返回的 askBroadcast 调用,进程里已经没有任何存活的闭包会再驱动它 settle,
                 // TTL 到点时 expireAsk 对一条非 STREAM_PENDING 行同样只会干净地输,一样什么都不做——挂死到进程
                 // 重启。修法:行不是 STREAM_PENDING ⇒ 不重新挂卡,直接回放既有终局(不落 pending、不 emit)。
-                if (existingOrCreated.state !== "STREAM_PENDING") {
+                if (existingOrCreated.row.state !== "STREAM_PENDING") {
                     releaseAdmission(); // X-2:回放既有终局 = 这只 ask 从未占用一条未决腿,名额立刻还回去
-                    return replayTerminalAskRow(existingOrCreated);
+                    return replayTerminalAskRow(existingOrCreated.row);
                 }
                 // 🔴 F2 修:行 = 真源。刚插的行上这三样与本地一致(采信是恒等操作);**重入**拿到既有行时,
                 // 采信才是唯一正确的做法 —— 帧、定时器、落库三处从此只有一个 deadline、一个 approvalId、一份卡。
@@ -820,17 +864,30 @@ export class ToolApprovalCoordinator {
                 // 跳过),而车4 的回决端点按 askId 仍决得动它:人有可能照着一份**不是行上那份**的卡做授权。
                 // 采信行上一个**无界/非有限**的 deadline 同样危险:它会把 pending 条目与准入名额钉在那里远超配置窗。
                 // 裁:两样任一不合 ⇒ 不编造替身、不发帧,**fail-safe 走 park**(行本身交给对账收敛器处理)。
-                const persistedEnvelope = ApprovalCardEnvelopeSchema.safeParse(existingOrCreated.cardJson);
-                const sanePersistedDeadline = Number.isFinite(existingOrCreated.expiresAtMs) && existingOrCreated.expiresAtMs <= Date.now() + effectiveWindowMs + DURABLE_CALL_TIMEOUT_MS;
+                const persistedEnvelope = ApprovalCardEnvelopeSchema.safeParse(existingOrCreated.row.cardJson);
+                const sanePersistedDeadline = Number.isFinite(existingOrCreated.row.expiresAtMs) && existingOrCreated.row.expiresAtMs <= Date.now() + effectiveWindowMs + DURABLE_CALL_TIMEOUT_MS;
                 if (!persistedEnvelope.success || !sanePersistedDeadline) {
-                    this.noteStoreError(new Error(`persisted approval row is unusable (envelopeOk=${persistedEnvelope.success}, deadlineOk=${sanePersistedDeadline})`), "ensureAsk(persisted-row-unusable)");
+                    // #168 件2:`inserted` 让这条臂能分清两种成因 —— 幂等命中的**别人的**行不合形(存量/旧版/坏行),
+                    // 与「本次刚写下的行自己读不回来」(店在改写我们的字节,或本地铸形与 schema 不一致)。处置相同
+                    // (都不编造替身、都走 park),但后者是本进程自己的账,归因不许并成前者。
+                    this.noteStoreError(new Error(`persisted approval row is unusable (envelopeOk=${persistedEnvelope.success}, deadlineOk=${sanePersistedDeadline}, ` +
+                        `origin=${existingOrCreated.inserted ? "row-this-call-just-inserted" : "row-hit-idempotently"})`), "ensureAsk(persisted-row-unusable)");
                     releaseAdmission();
                     return "unavailable"; // park 路由;绝不用一个编造的身份把这张卡推上 wire
                 }
-                persistedExpiresAtMs = existingOrCreated.expiresAtMs;
+                persistedExpiresAtMs = existingOrCreated.row.expiresAtMs;
                 wireApprovalId = persistedEnvelope.data.approvalId;
                 frame.approvalId = wireApprovalId; // 旧帧的去重键必须与新帧同值(两帧同带 approvalId 是消费端的对账口)
                 cardForFrame = persistedEnvelope.data.card;
+                // 🔴 [2942] codex 交叉复审 round1 [high](验真):`governanceForced` 也归入「行 = 真源」的 F2 家族。
+                // 本地判据(`governanceAskMarks`)是**进程内**表:它不跨副本、不跨重启。幂等命中一条既有行时
+                // (failover / 重启后重入),本地表恒空而行上的卡里存着它**落库那一刻**的判定 —— 两族帧若各读各的,
+                // 同一个 `approvalId` 会带着**互相矛盾**的出处上 wire(旧帧无键、呈卡帧 true,反向亦然)。
+                // 与 approvalId/deadline 同一条裁定:采信行。缺席也要**如实同步**(删键,不是留着本地的旧真值)。
+                if (cardForFrame.governanceForced === true)
+                    frame.governanceForced = true;
+                else
+                    delete frame.governanceForced;
             }
             catch (err) {
                 this.noteStoreError(err, "ensureAsk");

package/dist/trace/core-keyset-guard.d.ts

@@ -15,21 +15,35 @@
  * 维护:core 新键到来时,transparently 透传的加进对应 PROJECTED 并去实现投影;有意不上 wire 的加进
  * EXCLUDED 并写一行理由。谁改投影(project.ts / fleet-bus.ts / roster-store-sql.ts)谁同步本文件。
  */
-import type { TaskNotificationPayload, BackgroundChildEvent, RosterEntry, AskRequest, TaskEvent } from "@sema-agent/core";
+import type { TaskNotificationPayload, BackgroundChildEvent, RosterEntry, AskRequest, TaskEvent, MailboxMessage, MailboxStore } from "@sema-agent/core";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。 */
 type AssertAllKeysHandled<T extends never> = T;
 type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode";
-type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected>>;
+type NotificationExcluded = "peer";
+type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected | NotificationExcluded>>;
 type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId";
 type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "description" | "agentType" | "name" | "currentAction" | "currentTool" | "parentSessionId" | "startedAt" | "workflowRunId" | "progressTaskId" | "progressParentTaskId";
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation";
-type AskExcluded = "preview" | "principal" | "requiresRealApproval" | "riskAxes" | "boundInputHash";
+type AskExcluded = "preview" | "principal" | "requiresRealApproval" | "riskAxes" | "boundInputHash" | "ruleSuggestions";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
-export type CoreKeysetGuards = [_GuardNotification, _GuardBgNotif, _GuardRoster, _GuardAsk, _GuardTaskEvent];
+type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain";
+type _GuardMailbox = AssertAllKeysHandled<Exclude<keyof MailboxMessage, MailboxProjected>>;
+type MailboxAppendMessage = Parameters<MailboxStore["append"]>[2];
+type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain";
+type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
+export type CoreKeysetGuards = [
+    _GuardNotification,
+    _GuardBgNotif,
+    _GuardRoster,
+    _GuardAsk,
+    _GuardTaskEvent,
+    _GuardMailbox,
+    _GuardMailboxAppend
+];
 export {};
 //# sourceMappingURL=core-keyset-guard.d.ts.map

package/dist/trace/project.d.ts

@@ -12,7 +12,7 @@
  * old session-join `toolOutput` hook is gone, there's a real source now); `eventId`/`parentToolCallId` (§E2) ride
  * each content event, additive / tolerate-absent.
  */
-import type { TaskResult } from "@sema-agent/core";
+import type { ApprovalSettledBy, TaskResult } from "@sema-agent/core";
 import type { RunEvent, RunRecord } from "../plugins/store-contracts.js";
 import type { ModelUsageDelta, ModelUsageTracker, PromptManifestRecord } from "../budget.js";
 type AppendFn = (type: string, data: unknown) => Promise<void>;
@@ -90,6 +90,7 @@ export type TraceBlock = {
     totalChars?: number;
     structured?: unknown;
     errorCode?: string;
+    settledBy?: ApprovalSettledBy;
     eventId?: string;
     parentToolCallId?: string;
 } | {
@@ -131,6 +132,7 @@ export declare function toolEndEventData(ev: {
     totalChars?: number;
     structured?: unknown;
     errorCode?: string;
+    settledBy?: ApprovalSettledBy;
     eventId?: string;
     parentToolCallId?: string;
 }): Record<string, unknown>;
@@ -284,6 +286,13 @@ export declare function workspaceChangedEventData(ev: {
  *  · `interaction.posture`(三值:interactive / headless / absent)—— **裁:租户可见**。它是部署形的
  *    自述(这条腿有没有人能答问题),消费端据此决定渲不渲交互面;不是治理秘密,也不构成任何治理位的
  *    侧信道(它不参与 governance 那 4 个布尔的还原)。
+ *  · `permissionRules.storeWired`(布尔;core 5.18.0 design/179 新段)—— **裁:租户可见**。同族判据:
+ *    它与 `parkLane.capable` / `elicit.seamWired` / `fleet.backgroundAgentStore` 是同一类「这条腿接没接
+ *    某个可选设施」的部署形自述,而那三个早已租户可见。消费端的真需求也在租户侧:审批卡要不要渲染
+ *    「不再询问」这一格,取决于这台 worker 有没有规则店 —— 剥掉它,客户端只能靠试(提交后被拒)才知道。
+ *    它**不在** `governance` 段里(core 自己把它放在段外),也不构成那 4 个治理布尔的侧信道。
+ *    ⚠️ 恒在段(core 侧 `permissionRules` 无 `?`):本仓未接规则店 ⇒ `storeWired: false`,这是**真值**
+ *    不是缺席 —— 消费端读到 false 就是「这台 worker 没有这条车道」,不许当成「这版引擎还没这个概念」。
  * 未来 core 加一段而它没有 audience 标签时,**先在这里补一条裁定再决定挑不挑键** —— 段级完备性钉
  * (test/wiring-manifest-projection.test.ts)会在那一刻先把人拦下来。
  */

package/dist/trace/project.js

@@ -1,3 +1,6 @@
+// 值导入(非 `import type`):`settledBy` 的闭集判据必须**复用 core 的谓词**——本仓抄一份三元词表
+// 就是值拷贝漂移源(上游加员时两处静默不同步)。core 5.18.1 #187 导出的单一属主。
+import { isApprovalSettledBy } from "@sema-agent/core";
 import { redactSecrets, redactDeep } from "./redact.js";
 /** E8 (shell-host): drain the per-task model-usage accumulator into an append-only `model_usage` DELTA event.
  *  Shared by BOTH durable-write legs (runInBackground + the resume leg) so the persisted shape never drifts; the
@@ -163,6 +166,16 @@ export function toolEndEventData(ev) {
         // 带 default 臂,禁按两值穷举。verbatim 依据:码是机器短串标识符、非用户内容(不脱敏),边界靠
         // 显式上限而非词表 —— >128 字符=非法形,整键丢弃(不截断:截断会铸出 core 从未发过的码)。
         ...(typeof ev.errorCode === "string" && ev.errorCode.length <= 128 ? { errorCode: ev.errorCode } : {}),
+        // core 5.18.1 #187([3110] 提货批):`settledBy` = 这一次调用的**结算来源**("human"/"timeout"/
+        // "aborted"),只挂在经审批结算的那个 tool_end 上。与上面的 errorCode **不同族**,两条差别都承重:
+        //  ① 它是**闭集**,判据走 core 导出的 `isApprovalSettledBy`(单一属主)—— 不在本仓抄词表,也不拿
+        //     长度上限当边界(那是开集的兜底姿势,对闭集等于没门:出格词照样上 wire,下游按闭集写的
+        //     switch 会撞 default 或更坏地把它当成一次真结算)。上游加员时判据自动跟随。
+        //  ② **缺席不是语义**:core 契约逐字写「Absence = an older caller — consumers must not infer
+        //     semantics from a missing key」;姿态臂(headless auto-deny / 整体放行)本就不填。所以缺席
+        //     一律不铸键 —— 既不折 "human" 也不折 null,把「不知道」如实表达成「没有这个键」。
+        // 值是引擎铸的枚举短串、非用户内容 ⇒ 不脱敏。
+        ...(isApprovalSettledBy(ev.settledBy) ? { settledBy: ev.settledBy } : {}),
         ...identityFields(ev),
     };
 }
@@ -363,6 +376,13 @@ export function workspaceChangedEventData(ev) {
  *  · `interaction.posture`(三值:interactive / headless / absent)—— **裁:租户可见**。它是部署形的
  *    自述(这条腿有没有人能答问题),消费端据此决定渲不渲交互面;不是治理秘密,也不构成任何治理位的
  *    侧信道(它不参与 governance 那 4 个布尔的还原)。
+ *  · `permissionRules.storeWired`(布尔;core 5.18.0 design/179 新段)—— **裁:租户可见**。同族判据:
+ *    它与 `parkLane.capable` / `elicit.seamWired` / `fleet.backgroundAgentStore` 是同一类「这条腿接没接
+ *    某个可选设施」的部署形自述,而那三个早已租户可见。消费端的真需求也在租户侧:审批卡要不要渲染
+ *    「不再询问」这一格,取决于这台 worker 有没有规则店 —— 剥掉它,客户端只能靠试(提交后被拒)才知道。
+ *    它**不在** `governance` 段里(core 自己把它放在段外),也不构成那 4 个治理布尔的侧信道。
+ *    ⚠️ 恒在段(core 侧 `permissionRules` 无 `?`):本仓未接规则店 ⇒ `storeWired: false`,这是**真值**
+ *    不是缺席 —— 消费端读到 false 就是「这台 worker 没有这条车道」,不许当成「这版引擎还没这个概念」。
  * 未来 core 加一段而它没有 audience 标签时,**先在这里补一条裁定再决定挑不挑键** —— 段级完备性钉
  * (test/wiring-manifest-projection.test.ts)会在那一刻先把人拦下来。
  */
@@ -386,6 +406,7 @@ export function wiringManifestEventData(ev) {
     const fleetIn = sec(m.fleet) ?? {};
     const legIn = sec(m.leg) ?? {};
     const interactionIn = sec(m.interaction) ?? {};
+    const rulesIn = sec(m.permissionRules) ?? {};
     const ask = nonEmpty({
         ...(str(askIn.form) !== undefined ? { form: askIn.form } : {}),
         ...(str(askIn.provenance) !== undefined ? { provenance: askIn.provenance } : {}),
@@ -413,6 +434,11 @@ export function wiringManifestEventData(ev) {
         ...(bool(fleetIn.backgroundAgentStore) !== undefined ? { backgroundAgentStore: fleetIn.backgroundAgentStore } : {}),
         ...(bool(fleetIn.hostChildEventSink) !== undefined ? { hostChildEventSink: fleetIn.hostChildEventSink } : {}),
     });
+    // core 5.18.0 design/179 段(裁定见头注:租户可见)。逐键挑,与其余段同规:非布尔按缺席处理
+    // (不铸假值——一个编出来的 `false` 会被读成「确实没接规则店」,而真相是这段读不出来)。
+    const permissionRules = nonEmpty({
+        ...(bool(rulesIn.storeWired) !== undefined ? { storeWired: rulesIn.storeWired } : {}),
+    });
     return {
         ...(num(m.schemaVersion) !== undefined ? { schemaVersion: m.schemaVersion } : {}),
         ...(str(legIn.kind) !== undefined ? { leg: { kind: legIn.kind } } : {}),
@@ -423,6 +449,7 @@ export function wiringManifestEventData(ev) {
         ...(parkLane !== undefined ? { parkLane } : {}),
         ...(str(sessionIn.store) !== undefined ? { session: { store: sessionIn.store } } : {}),
         ...(fleet !== undefined ? { fleet } : {}),
+        ...(permissionRules !== undefined ? { permissionRules } : {}),
         // governance —— **刻意不在此**(见头注:受众标 operator,无投影不披露)。
         // configFingerprint —— **也刻意不在此**(codex 复审 2026-08-06 F1,验真后采纳)。剥掉一个段却把
         // **对它取的哈希**发出去,等于没剥:core 的算法是
@@ -685,6 +712,10 @@ export function toolResultFieldsOf(d) {
         // core 5.9.0 W3([2535]):机器可判别的 park/死投影码(`gate.parked`/`tool.not_found`)——写侧
         // toolEndEventData 已带,读腿必须同键 verbatim(absent⇒absent),否则冷回放退回锚 abort 文案字面。
         ...(typeof d.errorCode === "string" ? { errorCode: d.errorCode } : {}),
+        // core 5.18.1 #187:结算来源(闭集)——写侧 toolEndEventData 已带,读腿同键 verbatim(absent⇒absent)。
+        // 🔴 读腿的闭集门是**独立的一道**,不是写侧那道的复述:账本行可以来自任何引擎世代、任何第三方
+        // producer,写侧的门管不到它们;这里放行 = 把一个 core 从未发过的词直接送上 wire。
+        ...(isApprovalSettledBy(d.settledBy) ? { settledBy: d.settledBy } : {}),
         ...identityFields(d),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.4.0",
+  "version": "7.6.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.16.0",
+    "@sema-agent/core": "^5.19.0",
     "@sema-agent/registry-core": "^0.16.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^6.7.0",
+    "@sema-agent/sdk": "^6.9.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",

package/dist/boot/lexical-path-env.d.ts

@@ -1,10 +0,0 @@
-import { FileError, StubExecutionEnv, type Result } from "@sema-agent/core";
-/**
- * 无文件系统的路径裁决 env(见文件头)。只覆写 `absolutePath` 一面,其余全部继承 `StubExecutionEnv`
- * 的 `not_supported` ——**继承而非逐一手写**是刻意的:core 日后给 `ExecutionEnv` 加必填面时,新面会
- * 随 `StubExecutionEnv` 一起到位并保持同一个诚实答案,不会在这里留下一个悄悄编出来的假答案。
- */
-export declare class LexicalPathExecutionEnv extends StubExecutionEnv {
-    absolutePath(path: string): Promise<Result<string, FileError>>;
-}
-//# sourceMappingURL=lexical-path-env.d.ts.map