@sema-agent/server 7.47.0 → 7.48.0

package/dist/rules-consent.js

@@ -101,6 +101,27 @@ function refusedMembersOf(members) {
     }
     return refused;
 }
+const anchorLogger = createLogger();
+function anchorBatchMembers(members, displayed) {
+    const seatOf = new Map();
+    displayed.rules.forEach((r, i) => seatOf.set(r.rule, i));
+    const anchored = [];
+    for (const m of members) {
+        const memberIndex = seatOf.get(m.rule);
+        if (memberIndex === undefined) {
+            anchorLogger.warn("redeemed batch member is not a member of the offer the human confirmed — the receipt ships without per-rule anchors (core/dist skew?)", { rule: m.rule });
+            return { kind: "batch", rules: members.map((x) => x.rule) };
+        }
+        anchored.push({ memberIndex, rule: m.rule });
+    }
+    const distinctSeats = new Set(anchored.map((a) => a.memberIndex)).size;
+    if (anchored.length !== displayed.rules.length || distinctSeats !== anchored.length) {
+        anchorLogger.warn("redeemed batch does not line up one-to-one with the offer the human confirmed — the receipt ships without per-rule anchors (core/dist skew?)", { landed: anchored.length, offered: displayed.rules.length, distinctSeats });
+        return { kind: "batch", rules: members.map((x) => x.rule) };
+    }
+    anchored.sort((a, b) => a.memberIndex - b.memberIndex);
+    return { kind: "batch", rules: anchored.map((a) => a.rule), members: anchored };
+}
 export function createRuleConsentLane(stores, opts) {
     const deps = { provider: stores.provider, approvals: stores.approvals, cardEdits: true };
     const ticketTtlMs = opts?.ticketTtlMs ?? RULE_IMPORT_TICKET_TTL_MS;
@@ -158,7 +179,7 @@ export function createRuleConsentLane(stores, opts) {
                 if (refused.length > 0) {
                     return { ok: false, reason: "redeem-refused", detail: `partial batch: ${refused.length} member(s) refused (${refused.map((x) => x.reason).join("; ")})` };
                 }
-                return { ok: true, kind: "batch", rules: result.members.map((m) => m.rule), rev: result.rev };
+                return { ok: true, ...anchorBatchMembers(result.members, redemption.offer), rev: result.rev };
             }
             let ticket;
             if (redemption.kind === "offered") {

package/dist/tool-approval.d.ts

@@ -348,7 +348,20 @@ export type RuleRefusalReason = Extract<CardRulePersisted, {
  *  `rule_lane_unavailable` 刻意分词**:那个说的是「这台部署压根不供规则」(壳可以从此不渲这一格),
  *  这个说的是「规则车道好好的,只是**这一只** ask 归 operator 管」—— 折成同一个词会让壳把一台正常
  *  部署整条车道判死。 */
- | "rule_governance_forced";
+ | "rule_governance_forced"
+/**
+ * #363:**这一行**没有可铸规则的素材 —— durable(PARKED)迟到决议腿专属。
+ *
+ * 成因闭集(三条,处置相同):①这只 ask 从没进过规则车道(治理档 / 无属主 / 引擎没铸候选 / args 里
+ * 读不出命令原字节)⇒ `rule_command` 列 NULL;②行由**加这两列之前**的构建落下;③行上的卡读不回来
+ * (信封 schema 判假)⇒ 候选表与工具名都取不到。
+ *
+ * 🔴 **与 `rule_lane_unavailable` 刻意分词**(理由与上面那条 `rule_governance_forced` 逐字同源):
+ * 那个词的语义是「这台部署压根不供规则」,壳据它可以**从此不渲这一格**;而这里的真相是「车道好好的,
+ * 只是**这一行**上没有素材」—— 折成同一个词,一次 park 迟到答就能让壳把一台正常部署的整条车道判死。
+ * 静默忽略更不行(安全/审批轴禁静默 fail-open):人勾了「不再询问」而什么都没发生,他不会再勾第二次。
+ */
+ | "rule_material_absent";
 /**
  * #340([4763])—— `persistRule` 的**两个显式臂**在 wire 上的解析产物。
  *
@@ -1013,6 +1026,39 @@ export declare class ToolApprovalCoordinator {
      * 非 2xx 原样透出(gate 被别人收走 ⇒ 409 等),绝不粉饰成受理。
      */
     private redeemParkedAsk;
+    /**
+     * #363 —— **durable 回决腿的规则位**:PARKED 行的迟到决议携 `persistRule` 时,用**行上**的素材兑付。
+     *
+     * 回 `undefined` = 这次请求没带 `persistRule`(一个键都不加,老壳的回执逐字节不变);否则回一个
+     * `{rulePersisted, ruleRefusal?, …echo}` 片段,由调用点铺进 200 体 —— 与 live 腿 `withFlag` 的键集
+     * **同形**(壳的解析器一套判据吃两条腿)。
+     *
+     * ## 素材从哪来(这是本方法存在的全部理由)
+     * live 腿的等式左边是**进程内条目** `PendingApproval.ruleLane`,而 park 路由把条目连同素材一起散场
+     * 了(#329 的墓碑只桥身份,不携素材)。本腿因此从**行**取,一件一件对着 live 腿的入参:
+     *  · `command` = `rule_command` 列(**#363 新列**;缺席即本方法唯一的新拒因,见下);
+     *  · `scope` = `rule_scope_root` 列 ⇒ `{kind:"project", root}`,缺席则**不铸 scope**(core 落 global,
+     *    = live 腿 `material.scopeRoot` 缺席时逐字同形 —— 绝不在坐标系不明时编一个 root);
+     *  · 候选表 / `toolName` / 治理位 = 行上的 `card_json`(呈卡帧的同一份;**人看见的就是它**)。
+     *    ⚠️ 卡上的 `toolName` 带 200 字符的投影帽(`approval-card.ts` 的 `MAX_IDENT`),理论上可被截。
+     *    **那一支结构性 fail-closed、不会静默存错规则**:规则文本由 `toolName` + 命令派生,截过的名字
+     *    让 core 重铸出**另一条**规则 ⇒ 候选臂的文本等式当场不成立(`unknown-candidate`),编辑臂则被
+     *    core 自己的覆盖门拒。现网不可达(canonical / `mcp__srv__tool` 都远短于 200),记在这里免得
+     *    下一个人以为是漏了;
+     *  · `toolCallId` / `boundInputHash` = 行上的同名列(与 live 腿铸素材时读的是同一个 `req` 的同两件)。
+     *
+     * ## 三道门与 live 腿逐条同源(顺序也同,理由逐字见 `persistRuleAfterDecision`)
+     * 治理档先判(否则一只治理 ask 会拿到「这台部署不供规则」这个更宽的词)→ 车道/属主 → 素材 →
+     * `updatedInput`(ctrl+g 编辑放行 ⇒ `rule_input_edited`:生效的是编辑后的调用,而候选是从**原始**
+     * 命令铸的)→ 候选臂的文本等式。
+     *
+     * ## 与 live 腿**刻意不同**的一处:没有裁决前的自由文本预检(#345 的那道 400)
+     * 那道门的语义是「拒的时候这张卡还在,改好再来」;而本腿走到这里时赎回腿的 CAS **已经赢了**
+     * (checkpoint 已被消费),卡不可能还在 —— 400 回去只会把一次**已经生效**的放行谎报成失败。
+     * 所以编辑臂在本腿上照旧落「裁决受理 + `rulePersisted:false` + `edit-rejected`」那条老路(= #345
+     * 之前 live 腿的行为),如实登记为本腿的残余。
+     */
+    private persistRuleFromRow;
     /** #329:回执/单飞胜者的**回放形** —— 与首次受理同键集,多一位 `idempotent`,`decision` 恒是**受理时**
      *  那一向(反向重试不改判,与 DECIDED 臂同一条纪律)。 */
     private replayRedeemReceipt;

package/dist/tool-approval.js

@@ -24,6 +24,17 @@ const DEFAULT_PARK_TOMBSTONE_MAX = 2000;
 const DEFAULT_PARK_TOMBSTONE_TTL_MS = 60 * 60_000;
 const DEFAULT_PARK_TOMBSTONE_PER_PRINCIPAL_MAX = 128;
 const PARKING_RETRY_AFTER_MS = 250;
+function durableRuleMaterial(material) {
+    if (material === undefined)
+        return { ruleCommand: null, ruleScopeRoot: null };
+    if (redactSecrets(material.command, { observe: false }) !== material.command) {
+        defaultLogger.warn("approval rule material withheld: the adjudicated command carries credential-shaped bytes", {
+            commandChars: material.command.length,
+        });
+        return { ruleCommand: null, ruleScopeRoot: null };
+    }
+    return { ruleCommand: material.command, ruleScopeRoot: material.scopeRoot ?? null };
+}
 const DURABLE_CONVERGE_BACKOFF_MS = [50, 100, 200, 400, 800, 1600];
 const DURABLE_CONVERGE_READ_TIMEOUT_MS = 2_000;
 const DURABLE_CALL_TIMEOUT_MS = 5_000;
@@ -673,6 +684,7 @@ export class ToolApprovalCoordinator {
                     parentToolCallId: req.delegation?.parentToolCallId ?? null,
                     cardJson: buildApprovalCardEnvelope(id, card),
                     boundInputHash: readBoundInputHash(req),
+                    ...durableRuleMaterial(ruleLaneMaterial),
                     schemaVersion: 1,
                     expiresAtMs,
                     createdAtMs: attemptCreatedAtMs,
@@ -1166,7 +1178,7 @@ export class ToolApprovalCoordinator {
             return this.notPending("unknown_or_other_replica");
         }
         if (tomb.redeemed !== undefined)
-            return this.replayRedeemReceipt(id, tomb.askId, tomb.redeemed, parsed);
+            return this.replayRedeemReceipt(id, tomb, row, tomb.redeemed, parsed);
         switch (row.state) {
             case "DECIDED":
                 return this.replayDecidedAsk(id, row, parsed);
@@ -1237,18 +1249,19 @@ export class ToolApprovalCoordinator {
             return this.notPending();
         }
         if (tomb.redeemed !== undefined)
-            return this.replayRedeemReceipt(id, row.askId, tomb.redeemed, parsed);
+            return this.replayRedeemReceipt(id, tomb, row, tomb.redeemed, parsed);
         if (tomb.inflight !== undefined) {
             const shared = await tomb.inflight;
             if (shared.status < 200 || shared.status >= 300)
                 return shared;
-            return this.replayRedeemReceipt(id, row.askId, { decision: shared.decision, body: shared.body }, parsed);
+            return this.replayRedeemReceipt(id, tomb, row, { decision: shared.decision, body: shared.body, ...(shared.rule?.terminal === true ? { rule: shared.rule.body } : {}) }, parsed);
         }
         const decision = parsed.value === "deny" ? "deny" : "approve";
         const gateToken = row.gateToken;
         const flight = (async () => {
+            let res;
             try {
-                const res = await redeem({
+                res = await redeem({
                     askId: row.askId,
                     gateToken,
                     gateBoundCallId: row.gateBoundCallId,
@@ -1259,12 +1272,15 @@ export class ToolApprovalCoordinator {
                     ...(principal !== undefined ? { principal } : {}),
                     ...(httpReq !== undefined ? { httpReq } : {}),
                 });
-                return { ...res, decision };
             }
             catch (err) {
                 defaultLogger.error("tool approval parked redemption threw", { askId: row.askId, error: err instanceof Error ? err.message : String(err) });
                 return { status: 500, body: { error: "the parked approval could not be redeemed right now — retry", errorCode: "internal.error" }, decision };
             }
+            if (res.status < 200 || res.status >= 300)
+                return { ...res, decision };
+            const rule = await this.persistRuleFromRow(row, parsed);
+            return { ...res, decision, ...(rule !== undefined ? { rule } : {}) };
         })();
         tomb.inflight = flight;
         let out;
@@ -1276,7 +1292,8 @@ export class ToolApprovalCoordinator {
         }
         if (out.status < 200 || out.status >= 300)
             return { status: out.status, body: out.body };
-        tomb.redeemed = { decision, body: out.body };
+        const rule = out.rule;
+        tomb.redeemed = { decision, body: out.body, ...(rule?.terminal === true ? { rule: rule.body } : {}) };
         return {
             status: out.status,
             body: {
@@ -1285,22 +1302,118 @@ export class ToolApprovalCoordinator {
                 askId: row.askId,
                 accepted: "parked_redeemed",
                 ...(parsed.value === "allow_session" ? { rememberApplied: false } : {}),
-                ...this.lateRuleRefusal(parsed),
+                ...(rule?.body ?? {}),
             },
         };
     }
-    replayRedeemReceipt(id, askId, receipt, parsed) {
+    async persistRuleFromRow(row, parsed) {
+        const persistRule = parsed.persistRule;
+        if (persistRule === undefined)
+            return undefined;
+        const flag = (rulePersisted, ruleRefusal, echo) => ({
+            body: { rulePersisted, ...(ruleRefusal !== undefined ? { ruleRefusal } : {}), ...(echo ?? {}) },
+            terminal: true,
+        });
+        const lane = this.ruleConsent;
+        if (lane === undefined || row.owner === null)
+            return flag(false, "rule_lane_unavailable");
+        const owner = row.owner;
+        const envelope = ApprovalCardEnvelopeSchema.safeParse(row.cardJson);
+        if (!envelope.success)
+            return flag(false, "rule_material_absent");
+        const card = envelope.data.card;
+        if (card.governanceForced === true)
+            return flag(false, "rule_governance_forced");
+        const command = row.ruleCommand;
+        if (command === null)
+            return flag(false, "rule_material_absent");
+        if (parsed.updatedInput !== undefined)
+            return flag(false, "rule_input_edited");
+        const offers = card.ruleOffers ?? [];
+        const scope = row.ruleScopeRoot !== null ? { kind: "project", root: row.ruleScopeRoot } : undefined;
+        const common = {
+            principal: owner,
+            toolName: card.toolName,
+            command,
+            ...(row.toolCallId !== "" ? { toolCallId: row.toolCallId } : {}),
+            ...(row.boundInputHash !== null ? { boundInputHash: row.boundInputHash } : {}),
+            ...(scope !== undefined ? { scope } : {}),
+        };
+        try {
+            if (persistRule.kind === "batch") {
+                const offer = offers[persistRule.batchOfferIndex];
+                if (offer === undefined || offer.kind !== "batch")
+                    return flag(false, "rule_not_offered");
+                const persisted = await lane.persistCardRule({ ...common, redemption: { kind: "batch", offer } });
+                if (!persisted.ok) {
+                    defaultLogger.warn("permission rule batch was not persisted after a parked late decision", {
+                        askId: row.askId,
+                        reason: persisted.reason,
+                        ...(persisted.detail !== undefined ? { detail: redactSecrets(persisted.detail) } : {}),
+                    });
+                    return flag(false, persisted.reason);
+                }
+                return flag(true, undefined, persisted.kind === "batch"
+                    ? {
+                        persistedRules: persisted.rules,
+                        ...(persisted.members !== undefined
+                            ? { persistedRuleAnchors: persisted.members.map((m) => ({ offerIndex: persistRule.batchOfferIndex, memberIndex: m.memberIndex, rule: m.rule })) }
+                            : {}),
+                    }
+                    : {});
+            }
+            const ruleText = persistRule.rule;
+            if (!persistRule.edited && !offers.some((o) => o.kind === "single" && o.rule === ruleText))
+                return flag(false, "rule_not_offered");
+            const persisted = await lane.persistCardRule({
+                ...common,
+                redemption: persistRule.edited ? { kind: "edited", text: ruleText } : { kind: "offered", ruleText },
+            });
+            if (!persisted.ok) {
+                defaultLogger.warn("permission rule was not persisted after a parked late decision", {
+                    askId: row.askId,
+                    reason: persisted.reason,
+                    ...(persisted.detail !== undefined ? { detail: redactSecrets(persisted.detail) } : {}),
+                });
+                return flag(false, persisted.reason);
+            }
+            return flag(true, undefined, persistRule.edited && persisted.kind === "single" ? { persistedRule: persisted.rule } : {});
+        }
+        catch (err) {
+            this.noteStoreError(err, "persistCardRule(parked-late)");
+            return { ...flag(false, "rule_store_error"), terminal: false };
+        }
+    }
+    async replayRedeemReceipt(id, tomb, row, receipt, parsed) {
+        let rule = receipt.rule;
+        if (rule === undefined && parsed.persistRule !== undefined) {
+            const flight = tomb.ruleInflight ?? this.persistRuleFromRow(row, parsed);
+            const isOwner = tomb.ruleInflight === undefined;
+            if (isOwner)
+                tomb.ruleInflight = flight;
+            let fresh;
+            try {
+                fresh = await flight;
+            }
+            finally {
+                if (isOwner)
+                    tomb.ruleInflight = undefined;
+            }
+            rule = fresh?.body;
+            if (fresh?.terminal === true && tomb.redeemed !== undefined)
+                tomb.redeemed.rule = fresh.body;
+        }
         return {
             status: 200,
             body: {
                 ...receipt.body,
                 approvalId: id,
-                askId,
+                askId: row.askId,
                 accepted: "parked_redeemed",
                 idempotent: true,
                 decision: receipt.decision === "approve" ? "allow" : "deny",
                 ...(parsed.value === "allow_session" ? { rememberApplied: false } : {}),
-                ...this.lateRuleRefusal(parsed),
+                ...(rule ?? {}),
             },
         };
     }
@@ -1341,7 +1454,14 @@ export class ToolApprovalCoordinator {
                     defaultLogger.warn("permission rule batch was not persisted after an approval", { reason: persisted.reason, ...(persisted.detail !== undefined ? { detail: redactSecrets(persisted.detail) } : {}) });
                     return withFlag(false, persisted.reason);
                 }
-                return withFlag(true, undefined, persisted.kind === "batch" ? { persistedRules: persisted.rules } : {});
+                return withFlag(true, undefined, persisted.kind === "batch"
+                    ? {
+                        persistedRules: persisted.rules,
+                        ...(persisted.members !== undefined
+                            ? { persistedRuleAnchors: persisted.members.map((m) => ({ offerIndex: persistRule.batchOfferIndex, memberIndex: m.memberIndex, rule: m.rule })) }
+                            : {}),
+                    }
+                    : {});
             }
             catch (err) {
                 this.noteStoreError(err, "persistCardRule(batch)");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.47.0",
+  "version": "7.48.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",