@sema-agent/server 7.45.0 → 7.46.0-rc.2

package/dist/rules-consent.js

@@ -70,10 +70,11 @@ function confirmRefusalWord(reason) {
         case "edit_rejected":
             return "edit-rejected";
         case "record_not_found":
+        case "record_schema_stale":
+        case "record_malformed":
         case "selection_missing":
         case "selection_invalid":
         case "selection_mismatch":
-        case "batch_takes_no_selection":
         case "not_pending":
         case "conflict":
             return "confirm-refused";
@@ -84,6 +85,22 @@ function confirmRefusalWord(reason) {
         }
     }
 }
+function refusedMembersOf(members) {
+    const refused = [];
+    for (const m of members) {
+        switch (m.status) {
+            case "persisted":
+            case "deduped":
+                break;
+            case "refused":
+                refused.push(m);
+                break;
+            default:
+                throw new Error(`unknown redeemed-batch member status: ${JSON.stringify(m)}`);
+        }
+    }
+    return refused;
+}
 export function createRuleConsentLane(stores, opts) {
     const deps = { provider: stores.provider, approvals: stores.approvals, cardEdits: true };
     const ticketTtlMs = opts?.ticketTtlMs ?? RULE_IMPORT_TICKET_TTL_MS;
@@ -125,14 +142,33 @@ export function createRuleConsentLane(stores, opts) {
                 return { ok: false, reason: "no-candidates", detail: "the rule lane cannot speak for this command (compound / redirection / unsupported tool)" };
             }
             const redemption = input.redemption;
+            if (redemption.kind === "batch") {
+                const wanted = new Set(redemption.offer.rules.map((r) => r.rule));
+                const offerIndex = prepared.offers.findIndex((o) => o.kind === "batch" && o.rules.length === wanted.size && o.rules.every((r) => wanted.has(r.rule)));
+                if (offerIndex < 0) {
+                    return { ok: false, reason: "unknown-candidate", detail: "the confirmed batch is not the batch the engine now mints for this command (coverage drift) — re-trigger the command for a fresh card" };
+                }
+                const confirmed = await confirmRuleApproval({ approvalId: prepared.approvalId, principal: input.principal, selectedOffer: offerIndex, deps });
+                if (!confirmed.ok)
+                    return { ok: false, reason: "confirm-refused", detail: confirmed.reason };
+                const result = await redeemRuleBatch({ approvalId: prepared.approvalId, principal: input.principal, deps });
+                if ("status" in result)
+                    return { ok: false, reason: "redeem-refused", detail: result.reason };
+                const refused = refusedMembersOf(result.members);
+                if (refused.length > 0) {
+                    return { ok: false, reason: "redeem-refused", detail: `partial batch: ${refused.length} member(s) refused (${refused.map((x) => x.reason).join("; ")})` };
+                }
+                return { ok: true, kind: "batch", rules: result.members.map((m) => m.rule), rev: result.rev };
+            }
             let ticket;
             if (redemption.kind === "offered") {
+                const offerIndex = prepared.offers.findIndex((o) => o.kind === "single" && o.rule === redemption.ruleText);
                 const index = prepared.candidates.findIndex((c) => c.rule === redemption.ruleText);
                 const offered = index < 0 ? undefined : prepared.tickets[index];
-                if (index < 0 || offered === undefined) {
-                    return { ok: false, reason: "unknown-candidate", detail: "the chosen rule text is not one the engine minted for this command" };
+                if (offerIndex < 0 || index < 0 || offered === undefined) {
+                    return { ok: false, reason: "unknown-candidate", detail: "the chosen rule text is not a single offer the engine minted for this command" };
                 }
-                const confirmed = await confirmRuleApproval({ approvalId: prepared.approvalId, principal: input.principal, selectedCandidate: index, deps });
+                const confirmed = await confirmRuleApproval({ approvalId: prepared.approvalId, principal: input.principal, selectedOffer: offerIndex, deps });
                 if (!confirmed.ok)
                     return { ok: false, reason: "confirm-refused", detail: confirmed.reason };
                 ticket = offered;
@@ -169,7 +205,7 @@ export function createRuleConsentLane(stores, opts) {
             const redeemed = await redeemRuleTicket({ ticket, principal: input.principal, deps });
             if (redeemed.status !== "redeemed")
                 return { ok: false, reason: "redeem-refused", detail: redeemed.reason };
-            return { ok: true, rule: redeemed.rule, rev: redeemed.rev, alreadyRedeemed: redeemed.alreadyRedeemed };
+            return { ok: true, kind: "single", rule: redeemed.rule, rev: redeemed.rev, alreadyRedeemed: redeemed.alreadyRedeemed };
         },
         async prepareImport(principal, layers) {
             const ccLayers = layers.map((l) => ({
@@ -179,6 +215,9 @@ export function createRuleConsentLane(stores, opts) {
                 readFile: async () => l.content,
             }));
             const { preview, approvalId } = await prepareCcImport({ layers: ccLayers, principal, deps });
+            if (approvalId === undefined) {
+                return { ok: true, preview };
+            }
             if (preview.candidates.length > MAX_IMPORT_CANDIDATES) {
                 try {
                     await stores.approvals.discardPendingRecord?.(approvalId);
@@ -216,6 +255,9 @@ export function createRuleConsentLane(stores, opts) {
                 const record = await stores.approvals.get(consumed.approvalId);
                 if (record === undefined)
                     return { ok: false, reason: "record-unusable", detail: "the approval record behind this ticket is gone" };
+                if ("staleSchema" in record) {
+                    return { ok: false, reason: "record-unusable", detail: "this approval record predates the schema:2 form — re-run the import to mint a fresh record" };
+                }
                 if (buildRulePayloadHash(record.candidates) !== consumed.payloadHash) {
                     return { ok: false, reason: "payload-mismatch", detail: "the approval record's candidates changed after the ticket was minted" };
                 }
@@ -231,8 +273,9 @@ export function createRuleConsentLane(stores, opts) {
                 if ("status" in result) {
                     return await indeterminate(result.reason);
                 }
-                if (result.skippedAtRedeem.length > 0) {
-                    return await indeterminate(`partial import: ${result.skippedAtRedeem.length} candidate(s) did not land (${result.skippedAtRedeem.map((x) => x.reason).join("; ")})`);
+                const refused = refusedMembersOf(result.members);
+                if (refused.length > 0) {
+                    return await indeterminate(`partial import: ${refused.length} member(s) refused (${refused.map((x) => x.reason).join("; ")})`);
                 }
                 return { ok: true, result };
             }

package/dist/task-cwd.d.ts

@@ -44,7 +44,7 @@ export declare function inProcessSingleUserLane(config: {
  *      in-process 单用户 lane({@link inProcessSingleUserLane})取引擎自身 `process.cwd()`。它读起来像在
  *      服务一个真部署形,其实到不了 —— 该 lane 的 `remoteExec` 未设 ⇒ boot/execution-env.ts 六条工厂臂全
  *      不命中 ⇒ core 落 `StubExecutionEnv` ⇒ `handsEnabled=false` ⇒ 不挂 Bash ⇒ 未知工具在 agent-loop 走
- *      `tool.not_found`(**不进审批座**)⇒ 无 `ruleSuggestions` ⇒ 本函数在规则车道上根本不被调用;同 lane
+ *      `tool.not_found`(**不进审批座**)⇒ 无 `ruleOffers` ⇒ 本函数在规则车道上根本不被调用;同 lane
  *      第 1 臂也因写侧闸只在 `cwdHonored` 下开而恒空。危害口径按 refuter **降级**:死枝 ≡ 落第 3 臂
  *      `undefined` ≡ core global 缺省 ≡ #295 修前行为,**今天零用户可见伤害**,不是「恒不命中」类缺陷。
  *      🚧 **给将来接手的人的红线**:这条 lane 若哪天真接上 hands,root 必须取 `executionEnv.cwd`(core 的

package/dist/tool-approval.d.ts

@@ -1,5 +1,5 @@
 import type { IncomingMessage } from "node:http";
-import { type AskRequest, type AskOutcome } from "@sema-agent/core";
+import { type AskRequest, type AskOutcome, type RuleOffer } from "@sema-agent/core";
 import { type CardRulePersisted, type RuleConsentLane } from "./rules-consent.js";
 import { type ApprovalRequestFrame, type ApprovalRevokeFrame, type RuleEvidenceProjection } from "./approval-card.js";
 import type { ApprovalAskStore } from "./plugins/approval-ask-store-sql.js";
@@ -170,7 +170,8 @@ export interface ToolApprovalFrame {
     persistedRuleShadowed?: string;
     /**
      * #154 车二(core 5.18.0 design/179):`"tool_approval"` only —— 引擎为这次 ask 铸的**规则候选**
-     * (`AskRequest.ruleSuggestions`,逐字透传:闭词表 `match` + 引擎铸的文本,server 不重铸不重排)。
+     * (`AskRequest.ruleOffers`,core 5.58.0 判别联合逐字透传:闭词表 `kind`/`match` + 引擎铸的文本,
+     * server 不重铸不重排;序即契约——exact single 恒 0、batch 恒末,选择键=offer index)。
      * 壳据它渲「不再询问」,回决时用 `persistRule.rule` 报出选中的那一条。
      *
      * 🔴 **在场性即承诺**:只在**规则店真装配**(协调器拿到 `ruleConsent`,与 core 的
@@ -178,11 +179,7 @@ export interface ToolApprovalFrame {
      * `permissionRules.storeWired` 不可能相左)时在场。店缺席仍投 = 一格按下去无处可兑的「不再询问」,
      * 是 wire 谎言(判据逐字见 `trace/core-keyset-guard.ts` ④ 面本键那一段)。
      */
-    ruleSuggestions?: ReadonlyArray<{
-        rule: string;
-        match: "exact" | "prefix";
-        command: string;
-    }>;
+    ruleOffers?: readonly RuleOffer[];
     /**
      * #253 件 G1(core 5.33.0 backlog #239,判据帖 [3930] G1;**ADDITIVE**,`"tool_approval"` only)——
      * 这次 ask **为什么**被收紧的**结构化**因由(`AskRequest.probeCause`:工具的 `reversibilityProbe`
@@ -358,16 +355,29 @@ export type RuleRefusalReason = Extract<CardRulePersisted, {
  * `edited` 是判别位而不是「一个可选的第二字段」:候选臂的 `rule` 是**卡上那条候选的逐字文本**(定位键),
  * 编辑臂的 `rule` 是**人自己写的规则**。同一个字段两种含义,判别位必须显式带在同一个对象上。
  */
-export interface ParsedPersistRule {
+export type ParsedPersistRule = {
+    readonly kind: "text";
     readonly rule: string;
     readonly edited: boolean;
 }
+/** design/377(cli 1.0.92 合窗):人勾了 **batch** offer——合取批没有单条文本可抄,选择键=帧上
+ *  `ruleOffers` 的下标(卡=行素材=呈卡帧同源;server 侧兑付前另过防漂等式,见
+ *  `persistRuleAfterDecision` 的 batch 臂)。窄开只指 batch:single 臂的防伪锚是文本等式,
+ *  index 不许旁路它。 */
+ | {
+    readonly kind: "batch";
+    readonly batchOfferIndex: number;
+};
 /** #340:`persistRule.rule` 的形/上限拒句(wire 可见文案的**唯一**成形口 —— 冻结在
  *  `test/api-error-text-freeze.test.ts` 的常量锚格,与 `src/http/` 桶里的 `sendError` 站点同纪律)。 */
 export declare const PERSIST_RULE_TEXT_ERROR = "persistRule.rule must be a non-empty string of at most 512 characters";
 /** #340:`persistRule.edited` 的形拒句。非 boolean **绝不静默当 false** —— 那会把一次「我要落自由文本」
  *  悄悄折回候选臂,回来一句 `rule_not_offered`,而人以为自己写的规则被拒了。 */
 export declare const PERSIST_RULE_EDITED_FLAG_ERROR = "persistRule.edited must be a boolean when present";
+/** design/377:batch 选择键的形拒句(负数/非整数/非数一律响亮 400——一个被 |0 折过的下标指向的是另一条 offer)。 */
+export declare const PERSIST_RULE_BATCH_INDEX_ERROR = "persistRule.batchOfferIndex must be a non-negative integer when present";
+/** design/377:三臂互斥拒句。同场不静默取一——两臂说的是两次不同的授权,猜哪个都等于替人改主意。 */
+export declare const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOfferIndex is mutually exclusive with persistRule.rule / persistRule.edited \u2014 send exactly one arm";
 /**
  * #340 定界5:回决体**不收 scope**。
  *
@@ -584,7 +594,7 @@ export declare class ToolApprovalCoordinator {
      *  固定表(此时不进 ALS 作用域,读写都走这一张)。作用域理由见 `governance-ask-marks.ts` 顶注。 */
     private readonly governanceAskMarks;
     /** #154 车二:持久化权限规则的**同意车道**。在场 ⇔ 规则店真装配(main.ts 与 core 的
-     *  `RunnerDeps.permissionRuleStore` 同源于一个对象)⇒ ①ask 帧投 `ruleSuggestions`;②回决带
+     *  `RunnerDeps.permissionRuleStore` 同源于一个对象)⇒ ①ask 帧投 `ruleOffers`;②回决带
      *  `persistRule` 时兑付进店。缺席 ⇒ 两件都不做(诚实缺席,不发无处可兑的候选)。 */
     private readonly ruleConsent;
     /** #280 R-13 C(`UNATTENDED_APPROVAL_POLICY`,设计稿 §2):**无人可答**时这条部署要的终局。
@@ -693,7 +703,30 @@ export declare class ToolApprovalCoordinator {
      */
     /** 两份候选是否**逐条逐键**相等(顺序即展示序 ⇒ 顺序敏感)。两侧都缺席 = 相等;一侧缺席 = 不等。
      *  用在幂等重入的「行 = 真源」对账上(见 `ensureAsk` 那段撤回臂)。 */
-    private static ruleSuggestionsEqual;
+    private static ruleOffersEqual;
+    /**
+     * #346 / 5.58 复审 F-1 —— OFFER 的**文本座尺**(红先修)。
+     *
+     * 🔴 病灶(真复现,`npm run build --flag=<700 字> && git status`):`batch` 成员的 `segment` 是复合命令
+     * 那一段的**原字节**,它**不经** `parseAllowRuleText`,所以 core 的 `MAX_RULE_TEXT_CHARS` 对它一个字
+     * 都不管;而卡的 `ApprovalCardSchema` 对四个文本座一律 `.max(MAX_RULE_TEXT_CHARS)`。逐字拷进卡 ⇒
+     * `card_json` 落库 ⇒ `ensureAsk` 当场回读 `safeParse` 判假 ⇒ `persisted-row-unusable` ⇒ **整只 ask 走
+     * park**,重放腿一并跳过该行。与「重扫二轮 §基数帽」是**同一条悬崖的另一条边**(那次是 offer 条数
+     * 没执法,这次是文本长度),5.58 换形之前不存在——旧 `RuleSuggestion` 三个座全是解析器输出,结构性 ≤512。
+     *
+     * 两个座两种处置,**刻意不同**:
+     *  · `segment` = **纯渲染座**(core 明写「never adjudication input」)⇒ 截长是诚实省略,与
+     *    `toolName`/`message` 的 `clip` 同待遇,也与耐久腿 `boundedRuleOffers` 的同名处置同形。
+     *  · `rule`/`command` = **兑付等式的左边**(回决 `persistRule.rule` 按文本在引擎重铸的 offer 表里定位)
+     *    ⇒ 截一个字就恒 `rule_not_offered`,所以**绝不截**;真超尺(= core 放宽了自己的 512 或本仓与 core
+     *    版本不同步)⇒ **整条车道撤回**(返回 `undefined`),与本文件既有的治理撤回 / 漂移撤回逐字同形:
+     *    少渲一格是安全方向,渲一格按不动的才是 wire 谎言。今天这条臂不可达(每个座都是解析器产物),
+     *    它守的是版本不同步那一形 —— 与 `isSupportedRuleMatch` 的运行期 `default` 同族。
+     *
+     * 位置在**素材铸点**(与基数帽同一处):两族帧 + `card_json` + 回决口的等式左边从此拿的是**同一份**
+     * 已截素材,而不是两处各截一遍。
+     */
+    private static boundRuleOfferTexts;
     private buildRuleLaneMaterial;
     /** #241([3731]/[3730] 双属主裁定):把某 wire run 的**流内未决 ask** 立即转 durable park——断连支专用。
      *  匹配键=`ctxTaskId`(wire run id)。该字段的顶注说它「不是清扫判据」——那是因为清扫要判**连接**的

package/dist/tool-approval.js

@@ -6,7 +6,7 @@ import { hasBidiControls } from "./text-bidi.js";
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_SUGGESTIONS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readProbeCause, readRuleEvidence, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readProbeCause, readRuleEvidence, } from "./approval-card.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 const defaultLogger = createLogger();
 export const APPROVAL_GATE_KINDS = ["human", "irreversible_ask"];
@@ -42,6 +42,8 @@ function sessionAllowKey(owner, sessionId, category) {
 }
 export const PERSIST_RULE_TEXT_ERROR = `persistRule.rule must be a non-empty string of at most ${MAX_RULE_TEXT_CHARS} characters`;
 export const PERSIST_RULE_EDITED_FLAG_ERROR = "persistRule.edited must be a boolean when present";
+export const PERSIST_RULE_BATCH_INDEX_ERROR = "persistRule.batchOfferIndex must be a non-negative integer when present";
+export const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOfferIndex is mutually exclusive with persistRule.rule / persistRule.edited — send exactly one arm";
 export const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope — the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
 export function parseToolApprovalResponse(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
@@ -59,13 +61,24 @@ export function parseToolApprovalResponse(body) {
             if (pr.scope !== undefined)
                 return { ok: false, error: PERSIST_RULE_SCOPE_REFUSED };
             const rule = pr.rule;
-            if (typeof rule !== "string" || rule === "" || rule.length > MAX_RULE_TEXT_CHARS) {
-                return { ok: false, error: PERSIST_RULE_TEXT_ERROR };
-            }
             const edited = pr.edited;
-            if (edited !== undefined && typeof edited !== "boolean")
-                return { ok: false, error: PERSIST_RULE_EDITED_FLAG_ERROR };
-            persistRule = { rule, edited: edited === true };
+            const batchIdx = pr.batchOfferIndex;
+            if (batchIdx !== undefined) {
+                if (rule !== undefined || edited !== undefined)
+                    return { ok: false, error: PERSIST_RULE_BATCH_EXCLUSIVE_ERROR };
+                if (typeof batchIdx !== "number" || !Number.isInteger(batchIdx) || batchIdx < 0) {
+                    return { ok: false, error: PERSIST_RULE_BATCH_INDEX_ERROR };
+                }
+                persistRule = { kind: "batch", batchOfferIndex: batchIdx };
+            }
+            else {
+                if (typeof rule !== "string" || rule === "" || rule.length > MAX_RULE_TEXT_CHARS) {
+                    return { ok: false, error: PERSIST_RULE_TEXT_ERROR };
+                }
+                if (edited !== undefined && typeof edited !== "boolean")
+                    return { ok: false, error: PERSIST_RULE_EDITED_FLAG_ERROR };
+                persistRule = { kind: "text", rule, edited: edited === true };
+            }
         }
         const rawNote = body.note;
         let note;
@@ -244,12 +257,49 @@ export class ToolApprovalCoordinator {
                 this.admitByOwner.set(ownerKey, o);
         };
     }
-    static ruleSuggestionsEqual(a, b) {
+    static ruleOffersEqual(a, b) {
         if (a === undefined || b === undefined)
             return a === b;
         if (a.length !== b.length)
             return false;
-        return a.every((x, i) => x.rule === b[i].rule && x.match === b[i].match && x.command === b[i].command);
+        return a.every((x, i) => {
+            const y = b[i];
+            if (x.kind !== y.kind)
+                return false;
+            if (x.kind === "single" && y.kind === "single")
+                return x.rule === y.rule && x.match === y.match && x.command === y.command;
+            if (x.kind === "batch" && y.kind === "batch") {
+                return (x.uncoveredSegments === y.uncoveredSegments &&
+                    x.rules.length === y.rules.length &&
+                    x.rules.every((r, j) => r.rule === y.rules[j].rule && r.match === y.rules[j].match && r.command === y.rules[j].command && r.segment === y.rules[j].segment));
+            }
+            return false;
+        });
+    }
+    static boundRuleOfferTexts(offers) {
+        const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
+        const out = [];
+        for (const offer of offers) {
+            switch (offer.kind) {
+                case "single":
+                    if (over(offer.rule) || over(offer.command))
+                        return undefined;
+                    out.push(offer);
+                    break;
+                case "batch":
+                    if (offer.rules.some((r) => over(r.rule) || over(r.command)))
+                        return undefined;
+                    out.push({
+                        kind: "batch",
+                        rules: offer.rules.map((r) => (over(r.segment) ? { ...r, segment: r.segment.slice(0, MAX_RULE_TEXT_CHARS) } : r)),
+                        uncoveredSegments: offer.uncoveredSegments,
+                    });
+                    break;
+                default:
+                    return undefined;
+            }
+        }
+        return out;
     }
     buildRuleLaneMaterial(req, owner, governanceForced, sessionId) {
         if (this.ruleConsent === undefined)
@@ -258,10 +308,13 @@ export class ToolApprovalCoordinator {
             return undefined;
         if (owner === null)
             return undefined;
-        const rawSuggestions = req.ruleSuggestions;
-        if (!Array.isArray(rawSuggestions) || rawSuggestions.length === 0)
+        const rawOffers = req.ruleOffers;
+        if (!Array.isArray(rawOffers) || rawOffers.length === 0)
+            return undefined;
+        const capped = rawOffers.length > MAX_RULE_OFFERS ? rawOffers.slice(0, MAX_RULE_OFFERS) : rawOffers;
+        const offers = ToolApprovalCoordinator.boundRuleOfferTexts(capped);
+        if (offers === undefined)
             return undefined;
-        const suggestions = rawSuggestions.length > MAX_RULE_SUGGESTIONS ? rawSuggestions.slice(0, MAX_RULE_SUGGESTIONS) : rawSuggestions;
         const args = req.args;
         if (args === null || typeof args !== "object" || Array.isArray(args))
             return undefined;
@@ -272,7 +325,7 @@ export class ToolApprovalCoordinator {
         const scopeRoot = this.ruleScopeRootFor?.(sessionId);
         return {
             command,
-            suggestions,
+            offers,
             ...(typeof req.toolCallId === "string" && req.toolCallId !== "" ? { toolCallId: req.toolCallId } : {}),
             ...(boundInputHash !== null ? { boundInputHash } : {}),
             ...(scopeRoot !== undefined ? { scopeRoot } : {}),
@@ -576,11 +629,11 @@ export class ToolApprovalCoordinator {
             ...(typeof req.persistedRuleShadowed === "string" && req.persistedRuleShadowed !== ""
                 ? { persistedRuleShadowed: redactSecrets(req.persistedRuleShadowed).slice(0, MAX_RULE_TEXT_CHARS) }
                 : {}),
-            ...(ruleLaneMaterial !== undefined ? { ruleSuggestions: ruleLaneMaterial.suggestions } : {}),
+            ...(ruleLaneMaterial !== undefined ? { ruleOffers: ruleLaneMaterial.offers } : {}),
             ...((c) => (c !== undefined ? { probeCause: c } : {}))(readProbeCause(req)),
             ...((c) => (c !== undefined ? { ruleEvidence: c } : {}))(readRuleEvidence(req)),
             ...(bounded.omitted ? { argsOmitted: true } : { args: bounded.args }),
-            ...(bounded.hasBidi ? { inputHasBidi: true } : {}),
+            ...(bounded.hasBidi || req.hasBidiControls === true ? { inputHasBidi: true } : {}),
         };
         const effectiveWindowMs = effectiveAskWindowMs(this.ttlMs, this.windowMarginMs, origin.legDeadlineMonotonic, performance.now());
         const expiresAtMs = Date.now() + effectiveWindowMs;
@@ -662,18 +715,18 @@ export class ToolApprovalCoordinator {
                 if (cardForFrame.governanceForced === true && !effectiveGovernanceForced) {
                     effectiveGovernanceForced = true;
                     ruleLaneMaterial = undefined;
-                    delete frame.ruleSuggestions;
-                    if (cardForFrame.ruleSuggestions !== undefined) {
-                        const { ruleSuggestions: _dropped, ...rest } = cardForFrame;
+                    delete frame.ruleOffers;
+                    if (cardForFrame.ruleOffers !== undefined) {
+                        const { ruleOffers: _dropped, ...rest } = cardForFrame;
                         cardForFrame = rest;
                     }
                 }
-                if (ruleLaneMaterial !== undefined && !ToolApprovalCoordinator.ruleSuggestionsEqual(cardForFrame.ruleSuggestions, ruleLaneMaterial.suggestions)) {
-                    this.noteStoreError(new Error("persisted approval row offers a different ruleSuggestions set than this leg — withdrawing the rule lane for this delivery"), "ensureAsk(rule-suggestions-drift)");
+                if (ruleLaneMaterial !== undefined && !ToolApprovalCoordinator.ruleOffersEqual(cardForFrame.ruleOffers, ruleLaneMaterial.offers)) {
+                    this.noteStoreError(new Error("persisted approval row offers a different ruleOffers set than this leg — withdrawing the rule lane for this delivery"), "ensureAsk(rule-offers-drift)");
                     ruleLaneMaterial = undefined;
-                    delete frame.ruleSuggestions;
-                    if (cardForFrame.ruleSuggestions !== undefined) {
-                        const { ruleSuggestions: _drifted, ...rest } = cardForFrame;
+                    delete frame.ruleOffers;
+                    if (cardForFrame.ruleOffers !== undefined) {
+                        const { ruleOffers: _drifted, ...rest } = cardForFrame;
                         cardForFrame = rest;
                     }
                 }
@@ -1051,7 +1104,7 @@ export class ToolApprovalCoordinator {
     }
     precheckEditedRuleBeforeDecision(entry, parsed) {
         const persistRule = parsed.persistRule;
-        if (persistRule === undefined || !persistRule.edited)
+        if (persistRule === undefined || persistRule.kind !== "text" || !persistRule.edited)
             return undefined;
         if (parsed.updatedInput !== undefined)
             return undefined;
@@ -1073,7 +1126,7 @@ export class ToolApprovalCoordinator {
         };
     }
     editedArmEcho(persistRule, persisted) {
-        if (!persistRule.edited || !persisted.ok)
+        if (persistRule.kind !== "text" || !persistRule.edited || !persisted.ok || persisted.kind !== "single")
             return {};
         return { persistedRule: persisted.rule };
     }
@@ -1258,7 +1311,6 @@ export class ToolApprovalCoordinator {
         const lane = this.ruleConsent;
         const material = entry.ruleLane;
         const owner = entry.owner;
-        const ruleText = persistRule.rule;
         const withFlag = (rulePersisted, ruleRefusal, echo) => ({
             status: result.status,
             body: { ...result.body, rulePersisted, ...(ruleRefusal !== undefined ? { ruleRefusal } : {}), ...(echo ?? {}) },
@@ -1271,7 +1323,33 @@ export class ToolApprovalCoordinator {
             return withFlag(false, "rule_store_error");
         if (inputWasEdited)
             return withFlag(false, "rule_input_edited");
-        if (!persistRule.edited && !material.suggestions.some((s) => s.rule === ruleText))
+        if (persistRule.kind === "batch") {
+            const offer = material.offers[persistRule.batchOfferIndex];
+            if (offer === undefined || offer.kind !== "batch")
+                return withFlag(false, "rule_not_offered");
+            try {
+                const persisted = await lane.persistCardRule({
+                    principal: owner,
+                    toolName: entry.toolName,
+                    command: material.command,
+                    redemption: { kind: "batch", offer },
+                    ...(material.toolCallId !== undefined ? { toolCallId: material.toolCallId } : {}),
+                    ...(material.boundInputHash !== undefined ? { boundInputHash: material.boundInputHash } : {}),
+                    ...(material.scopeRoot !== undefined ? { scope: { kind: "project", root: material.scopeRoot } } : {}),
+                });
+                if (!persisted.ok) {
+                    defaultLogger.warn("permission rule batch was not persisted after an approval", { reason: persisted.reason, ...(persisted.detail !== undefined ? { detail: redactSecrets(persisted.detail) } : {}) });
+                    return withFlag(false, persisted.reason);
+                }
+                return withFlag(true, undefined, persisted.kind === "batch" ? { persistedRules: persisted.rules } : {});
+            }
+            catch (err) {
+                this.noteStoreError(err, "persistCardRule(batch)");
+                return withFlag(false, "rule_store_error");
+            }
+        }
+        const ruleText = persistRule.rule;
+        if (!persistRule.edited && !material.offers.some((o) => o.kind === "single" && o.rule === ruleText))
             return withFlag(false, "rule_not_offered");
         try {
             const persisted = await lane.persistCardRule({

package/dist/trace/core-keyset-guard.d.ts

@@ -26,8 +26,8 @@ type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "descripti
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleSuggestions" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval";
-type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval";
+type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.45.0",
-  "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
+  "version": "7.46.0-rc.2",
+  "description": "Sema Server \u2014 the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
   "main": "dist/index.js",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.57.0",
+    "@sema-agent/core": "^5.59.0",
     "@sema-agent/registry-core": "^0.19.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",