@sema-agent/server 7.55.0 → 7.57.0

package/dist/tool-approval.d.ts

@@ -22,10 +22,10 @@ export declare const APPROVAL_GATE_KINDS_SQL_IN: string;
  * 因此续跑」。反面(真被消费)不铸键 —— additive 只记真,与 `updatedInputForwarded`/`decisionNote`
  * 的先例逐字同族。**缺席禁读作「有消费者」的证明**:老版本 server 从不发这个键。
  *
- * 成因三形([ref] 复审件3 补第三形):①持有悬挂 promise 的是**另一个副本**;②本副本重启后本地窗已空;
- * ③**弃单墓碑守卫把素批准翻成 park**({@link ToolApprovalCoordinator.guardRowDerivedApprove}:本地腿
- * 在场,但没有一条把这次 approve 当**放行**消费 —— 它们全部收成 park,人须经 durable 门再兑)。
- * 三形的处置同一句:壳读 run 面判续跑没有,绝不把 200 无键当成「run 已续跑」的证明。
+ * 成因两形([ref] 起;[ref] 复审件3 曾补的第三形 = 弃单墓碑守卫翻 park,随守卫整删退役。进程内仍可
+ * 短暂出现「腿在场而零交付」:编辑在飞让路 —— 标记放开后的下一拍按行兑现):①持有悬挂 promise 的是
+ * **另一个副本**;②本副本重启后本地窗已空。
+ * 两形的处置同一句:壳读 run 面判续跑没有,绝不把 200 无键当成「run 已续跑」的证明。
  *
  * 为什么不是 409/410(施工时的二选一,裁定写在这里):409/410 说的是「你的请求没有生效」,而这次决议
  * **确实生效了**(行是 DECIDED,幂等回放读得到、审计面记得住)——把它渲成错误会让壳把一次成功的
@@ -323,6 +323,10 @@ export interface LivePendingRow {
      *  子代 ask)上恒等成立。缺席 = 顶层 ask。`fromSubagent` 保留不动(byte-compat:先于本键的消费方仍按
      *  它判别)。 */
     originTaskId?: string;
+    /** [ref]([ref]②):内容问句分型 —— `"content_ask"` 当 `toolName` 为 AskUserQuestion(词属主
+     *  `approval-content-kind.ts`,与 durable 两读面 / core summarize 面同词,OMIT 契约同族)。
+     *  缺席 = 普通工具 ask。展示/分诊分型用,永不参与决议路由。 */
+    contentKind?: "content_ask";
 }
 export interface ToolApprovalRunContext {
     taskId: string;
@@ -537,6 +541,10 @@ export declare function resolveStreamApprovalGate(input: StreamApprovalGateInput
  * `prepare-task.js` 的 durableMandate/contentMandate(:1415/:1417)与 durableQuestionFace(:2136)等),
  * 故不在本函数内。
  *
+ * 🔴 **[ref](半接线旋钮族)**:`windowZero` 的第一源(`STREAM_ASK_WINDOW_MS=0`)自此**不再挂在
+ * `streamApprovalOn` 后面** —— 那是部署级旋钮,它的语义不该因为这台机器有没有 durable ask 账而改变
+ * (`ApprovalLegAssembly.windowZero` 顶注写了那条病)。第三源(贴 deadline)照旧只在协议上场时参与。
+ *
  * **`windowZero` 的两件事必须同时做**(调用方契约):不包 ALS **且**注入 immediate-unavailable 闭包。
  * 只做一件另一条路仍会呈卡。⚠️ [ref] 起**三腿都有** per-task `spec.onAsk` 装配点(sync=routes/tasks.ts,
  * bg=runs.ts,resume=server.ts driveResumeLeg),windowZero 的第二件在三腿都是显式闭包 —— 旧文「bg/
@@ -550,7 +558,14 @@ export interface ApprovalLegAssembly {
      *  同 (owner, session) 活流呈活卡(sync 腿 [ref] 起本就如此;bg/resume 的这条行为差 = [ref] CHANGELOG
      *  披露的行为面变更)。旧文「本腿逐字保持协议之前的行为」只对协议件成立,别再把它读成「协议关 = 零呈卡」。 */
     active: boolean;
-    /** §8.3 窗=0 恒 park。`active` 为假时恒 false(协议都没上场,谈不上关窗)。 */
+    /** §8.3 窗=0 恒 park。
+     *  🔴 **[ref] 起它与 `active` 解耦**(旧文「`active` 为假时恒 false —— 协议都没上场,谈不上关窗」已
+     *  作废):`STREAM_ASK_WINDOW_MS` 是**部署级**旋钮,`0` 的语义(运维显式关窗 ⇒ 恒走
+     *  {@link ToolApprovalCoordinator.unattendedAskOutcome},连卡都不发)在两条车道上必须是同一个意思。
+     *  旧形下 local 车道(`volatile_ask_ledger`)/ 无 park 设施 / 显式关协议的部署配了 `0`,拿到的是一张
+     *  等满 5min 的活卡 —— 与它自己的域注正好相反,且没有任何一行说出来。
+     *  ⚠️ 「窗**缺席**」(`windowMs: undefined` = 这份装配根本没有 streamApproval 段,只出现在 stub-harness)
+     *  **不是**关窗:那时逐字保持活卡腿。 */
     windowZero: boolean;
     /** §7.3 本 leg 的 walltime deadline(`performance.now()` 单调基)。只在 `active ∧ ¬windowZero ∧
      *  有 walltime 墙` 时在场 —— 关着时供值会把既有 5min 活卡窗按三元公式缩短(§7.2 真行为变更)。 */
@@ -579,8 +594,13 @@ export declare function createApprovalCardEmitter(sinks: {
 export declare function resolveApprovalLeg(input: {
     /** = `resolveStreamApprovalGate(...).active`(协议在本 worker 上场没有)。 */
     streamApprovalOn: boolean;
-    /** `config.streamApproval.windowMs`(`STREAM_ASK_WINDOW_MS`)。 */
-    windowMs: number;
+    /** `config.streamApproval.windowMs`(`STREAM_ASK_WINDOW_MS`)。
+     *  🔴 [ref]:`undefined` = **这份装配没有 `streamApproval` 段**(只出现在只填被测键的 stub-harness ——
+     *  真实 boot 无条件铸该段,见 `config.ts`)。此前三个调用点各写 `?? 0` 把这一形折成「0」,在旧语义下
+     *  是死代码(`windowZero` 那时挂在 `streamApprovalOn` 后面,协议关就恒 false);[ref] 让 `0` 在协议关的
+     *  腿上也真生效之后,那个折算会把一台**什么都没配**的 harness 判成「运维显式关窗」。故本字段收成
+     *  `number | undefined`,由每个调用点如实交出「有没有这个值」,不许再就地编一个。 */
+    windowMs: number | undefined;
     /** `config.streamAskWindowMarginMs`(`STREAM_ASK_WINDOW_MARGIN_MS`)。 */
     windowMarginMs: number;
     /** `spec.limits.maxWalltimeMs`。缺席 = 没有 walltime 墙 ⇒ 第三源不参与(**缺席 ≠ 0**)。 */
@@ -670,10 +690,6 @@ export declare class ToolApprovalCoordinator {
     /** [ref] + codex R3-[critical]:askId → **此刻正带着 `updatedInput` 决它的请求数**(见
      *  {@link markEditedDecisionInFlight} 顶注)。只在 `decideAsk` 那一次调用期间非空,故天然有界。 */
     private readonly editedDecisionsInFlight;
-    /** [ref] + codex R6-[critical]:askId → **弃单墓碑**到期时刻。看门狗放弃一枚在飞编辑标记时落一条,
-     *  此后行派生的 approve 对这只 ask 改走 park 路由(理由见 {@link notifyExternalDecision} 里那段)。
-     *  有界两道:条目自带 TTL(惰性过期)+ 表大小 FIFO 上限,同 park 墓碑表的纪律。 */
-    private readonly abandonedEditedDecisions;
     /** [ref] 车2(D5 一次性 warn 节流):同实例只报第一次,后续只计数(避免 store 抖动期间刷屏)。 */
     private storeErrorWarned;
     private storeErrorTally;
@@ -802,6 +818,8 @@ export declare class ToolApprovalCoordinator {
     /** 两份候选是否**逐条逐键**相等(顺序即展示序 ⇒ 顺序敏感)。两侧都缺席 = 相等;一侧缺席 = 不等。
      *  用在幂等重入的「行 = 真源」对账上(见 `ensureAsk` 那段撤回臂)。 */
     private static ruleOffersEqual;
+    private static batchMemberEqual;
+    private static uncoveredDetailEqual;
     /**
      * [ref] / 5.58 复审 F-1 —— OFFER 的**文本座尺**(红先修)。
      *
@@ -824,6 +842,11 @@ export declare class ToolApprovalCoordinator {
      * 位置在**素材铸点**(与基数帽同一处):两族帧 + `card_json` + 回决口的等式左边从此拿的是**同一份**
      * 已截素材,而不是两处各截一遍。
      */
+    /** 兑付侧座(single 的 rule/command、command 成员的 rule/command、directoryRead 成员的 rule/directory)任一超尺?
+     *  `segment` 与 `uncoveredDetail[].segment` 是纯渲染座,不在此列(截长是诚实省略)。 */
+    private static ruleOfferTextsOverSize;
+    /** codex r1 [high]([ref]):offer 的自称座与 `parseAllowRuleText(rule)` 派生的三元组逐字一致?(理由见调用点) */
+    private static ruleOfferDerivedFactsAgree;
     private static boundRuleOfferTexts;
     private buildRuleLaneMaterial;
     /** [ref]([ref]/[ref] 双属主裁定):把某 wire run 的**流内未决 ask** 立即转 durable park——断连支专用。
@@ -911,8 +934,7 @@ export declare class ToolApprovalCoordinator {
      * 争终局与读真相并成店的一次原子 claim,分类器只剩纯函数半场。[ref](行派生 approve 丢编辑)已随
      * [ref] 落列收口:`approved` 臂带行上的 `updatedInput`。
      *
-     * 行派生 approve 的两道守卫**在这里**施加(五处消费一份判据,见 {@link guardRowDerivedApprove}):
-     *  · 弃单墓碑在场 ⇒ `parked`(park 路由,可逆可再批 —— 绝不把一个证不出载荷的放行交出去);
+     * 行派生 approve 的守卫只剩一道**在这里**施加([ref]:弃单墓碑守卫随 [ref] 落列整删,见文件头 🪦 注):
      *  · 编辑在飞 ⇒ `edit-in-flight`(codex R4-[critical] 同族口:载荷还在别人手里的那一拍按行结算 = 用裸
      *    `true` 抢在它前面;持有者随后必定自己结算)。
      */
@@ -1224,15 +1246,6 @@ export declare class ToolApprovalCoordinator {
         backlog: number;
         truncated: boolean;
     }>;
-    /**
-     * [ref](案A)+ codex [critical] 的**前置门读口**:本副本对这条持久 askId 还有几条**未结算**的活体登记。
-     *
-     * 唯一消费者 = durable 回决口(`routes/runs.ts`)在 CAS **之前**判「这次带来的 `updatedInput` 交得出去
-     * 吗」—— 交不出去就响亮拒,绝不静默把编辑降级成不带编辑的批准(判据与理由全文在那个调用点)。
-     * 返回 0 的两种成因(**刻意不分**):等待的 promise 在**别的副本**,或那条 run 已经死了(重启后本地窗空)。
-     * 两者的处置相同(这次编辑在这里都落不了地),而分辨它们需要读 run 面 —— 那不是本口能回答的问题。
-     */
-    liveConsumerCount(askId: string): number;
     /**
      * 🔴 [ref] + codex R3-[critical](真缺陷,红先复现器在 `test/case-a-reachability-queue.test.ts` 同名格)
      * —— **带编辑的决议在飞期间,观察者不结算**。
@@ -1260,48 +1273,10 @@ export declare class ToolApprovalCoordinator {
     editedDecisionInFlightCount(askId: string): number;
     /** {@link markEditedDecisionInFlight} 的读口:此刻有没有**别的**请求正带着编辑决这只 ask。 */
     editedDecisionInFlight(askId: string): boolean;
-    /**
-     * 弃单墓碑的读口(**惰性过期**:读到过期即删,不另起定时器 —— 同 park 墓碑表的姿势)。
-     * 在场 = 这只 ask 曾有一次带编辑的决议在飞而看门狗放弃了它 ⇒ **行派生**的 approve 一律改走 park 路由。
-     *
-     * 🔴 **过期/逐出必须 fail-closed**(codex R7-[high],验真后采纳):首版是「到点就删」——而它保护的是
-     * 一条**仍然挂着**的本地等待腿。店退化到十分钟以上、或并发弃单超过表帽时,墓碑先消失、腿还在,下一次
-     * 行派生 approve 照样把原始命令放出去,正好复活它要防的那件事。判据改成:**丢墓碑之前先把它保护的
-     * 消费者收掉**(park 路由,可逆可再批)。收完之后再删就是安全的 —— 没有腿可被误放行了。
-     */
-    private abandonedEditedDecisionPending;
-    /**
-     * 🔴 **行派生 approve 的统一守卫**(codex R7-[critical],验真后修)。
-     *
-     * R6 把弃单墓碑的兑现点收在 {@link notifyExternalDecision} 上,并自称「公共咽喉」—— 那句话**不成立**:
-     * 树上还有三处**直接** `settle(true, …)` / 直接把 `true` 交回 core 的行派生回放(`convergeFromDurableState`
-     * 的收敛臂、`ensureAsk` 幂等命中终局行的回放、窗到期报错臂的 `readDecidedForRecovery` —— [ref] 起前者与
-     * 后者合并成 `readRowForRecovery` 一个读口、三臂共用;[ref] 起读口撤销,同一份判据长在 claim 败方读数的
-     * 分类器 `classifyClaimLoss` 里),它们跳过那个口。于是弃单之后从这三条路上仍能放出原始命令。
-     *
-     * 收口形 = **一个判据函数、五处消费**(上面三处 + 轮询 + HTTP 观察者):把「行说 approve」这件事
-     * 在弃单墓碑在场时翻译成 `"unavailable"`(park 路由,可逆可再批),其余取值逐字透传。
-     * 判据只认**不带编辑的行派生**放行(裸 `true`)—— 人的当次决议带着 `updatedInput` 走的是另一条路,不经
-     * 本函数;[ref] 之后行上带编辑的 approve 回放出来是对象臂 `{allow:true, updatedInput}`,载荷**在行上**,
-     * 墓碑要护的「证不出载荷」这件事对它不成立,同样原样透传。
-     * ⚠️ 既有边界如实记([ref] 随批复核):列在之后,一只 ask 的决议**要么**带编辑落列(回放恒对象臂,本
-     * 守卫永不命中)**要么**从没带过编辑(从没设过在飞标记,永无墓碑)⇒ 本守卫在新行上结构上不再可达,
-     * 留着只为老进程/老行的并存窗与既有判据格;拆除是独立件([ref] 登记),不搭本批。
-     */
-    private guardRowDerivedApprove;
-    /** 丢一枚弃单墓碑的**唯一**口(过期 / 容量逐出共用):先把它还在保护的本地消费者按 park 路由收掉,
-     *  再删表项 —— 顺序是硬的(先删表再收人 = 中间那一瞬正是可被误放行的窗口)。 */
-    private dropAbandonedEditTombstone;
-    /** 判据钩子:把「看门狗那一拍」显式地跑一次(留弃单墓碑 + 让在飞标记归零)。
-     *  存在理由 = 那条臂的真实触发要等 {@link EDITED_DECISION_MARK_CAP_MS} 的墙钟,而本仓禁固定睡眠钉
-     *  (fixed-sleep 棘轮);把**语义**开一个口比让判据去睡 10 秒诚实得多。生产路径不调它。 */
+    /** 判据钩子:把「看门狗那一拍」显式地跑一次(= 在飞标记被放弃归零;[ref] 起看门狗不再铸弃单墓碑,
+     *  本钩子随之只剩这一半)。存在理由 = 那条臂的真实触发要等 {@link EDITED_DECISION_MARK_CAP_MS} 的
+     *  墙钟,而本仓禁固定睡眠钉(fixed-sleep 棘轮)。生产路径不调它。 */
     expireEditedDecisionMarkForTest(askId: string): void;
-    /** 判据钩子:把一枚弃单墓碑**拨到已过期**并当场走它的丢弃路(= 真实 TTL 到点那一拍的语义)。
-     *  同上理由:真触发要等 {@link ABANDONED_EDIT_TOMBSTONE_TTL_MS} 的墙钟。生产路径不调它。 */
-    forceAbandonedEditTombstoneExpiryForTest(askId: string): void;
-    /** 判据钩子:把一枚弃单墓碑的到期时刻**改写**成给定值(不触发惰性过期口本身)。用来构造
-     *  「墓碑已过期、但还没有任何人来读过它」这一拍 —— 那正是「触发过期的那次调用还护不护」的判据点。 */
-    setAbandonedEditTombstoneDeadlineForTest(askId: string, atMs: number): void;
     /** Test/observability hooks. */
     pendingCount(): number;
     /** [ref]:当前挂着的**悬挂**条目数(零投递集合铸的那一类)——运维/判据读它证「悬挂队列有多长」。 */

package/dist/tool-approval.js

@@ -1,5 +1,6 @@
+import { contentKindOf } from "./approval-content-kind.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, MAX_RULE_TEXT_CHARS } from "@sema-agent/core";
+import { uuidv7, MAX_RULE_TEXT_CHARS, parseAllowRuleText } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
 import { redactDeep, redactSecrets } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -7,7 +8,7 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readProbeCause, readRuleEvidence, readRuleOffersAbsence, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readProbeCause, readRuleEvidence, readRuleOffersAbsence, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 const defaultLogger = createLogger();
@@ -22,8 +23,6 @@ const DEFAULT_UNREACHED_ASK_TTL_MS = 60 * 60_000;
 const SUSPENDED_POLL_MAX_PER_TICK = 64;
 const SUSPENDED_POLL_BUDGET_MS = 5_000;
 const EDITED_DECISION_MARK_CAP_MS = 10_000;
-const ABANDONED_EDIT_TOMBSTONE_TTL_MS = 10 * 60_000;
-const ABANDONED_EDIT_TOMBSTONE_MAX = 256;
 const DEFAULT_WINDOW_MARGIN_MS = 10_000;
 const MAX_ALLOW_SESSIONS = 4096;
 const DEFAULT_ADMIT_MAX_PER_TASK = 32;
@@ -196,7 +195,7 @@ export function createApprovalCardEmitter(sinks) {
 }
 export function resolveApprovalLeg(input) {
     if (!input.streamApprovalOn)
-        return { active: false, windowZero: false };
+        return { active: false, windowZero: input.windowMs === 0 };
     const tightDeadline = input.legWalltimeMs !== undefined && input.legWalltimeMs - input.windowMarginMs <= 0;
     if (input.windowMs === 0 || tightDeadline)
         return { active: true, windowZero: true };
@@ -269,7 +268,6 @@ export class ToolApprovalCoordinator {
     admitByOwner = new Map();
     suspendedPollOffset = 0;
     editedDecisionsInFlight = new Map();
-    abandonedEditedDecisions = new Map();
     storeErrorWarned = false;
     storeErrorTally = 0;
     governanceAskMarks;
@@ -346,32 +344,115 @@ export class ToolApprovalCoordinator {
             if (x.kind === "batch" && y.kind === "batch") {
                 return (x.uncoveredSegments === y.uncoveredSegments &&
                     x.rules.length === y.rules.length &&
-                    x.rules.every((r, j) => r.rule === y.rules[j].rule && r.match === y.rules[j].match && r.command === y.rules[j].command && r.segment === y.rules[j].segment));
+                    x.rules.every((r, j) => ToolApprovalCoordinator.batchMemberEqual(r, y.rules[j])) &&
+                    ToolApprovalCoordinator.uncoveredDetailEqual(x.uncoveredDetail, y.uncoveredDetail));
             }
             return false;
         });
     }
+    static batchMemberEqual(r, s) {
+        if (r.kind !== s.kind)
+            return false;
+        if (r.kind === "command" && s.kind === "command")
+            return r.rule === s.rule && r.match === s.match && r.command === s.command && r.segment === s.segment;
+        if (r.kind === "directoryRead" && s.kind === "directoryRead")
+            return r.rule === s.rule && r.directory === s.directory && r.segment === s.segment;
+        return false;
+    }
+    static uncoveredDetailEqual(a, b) {
+        if (a === undefined || b === undefined)
+            return a === b;
+        return a.length === b.length && a.every((d, i) => d.segment === b[i].segment && d.reason === b[i].reason);
+    }
+    static ruleOfferTextsOverSize(offer) {
+        const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
+        if (offer.kind === "single")
+            return over(offer.rule) || over(offer.command);
+        return offer.rules.some((r) => {
+            switch (r.kind) {
+                case "command":
+                    return over(r.rule) || over(r.command);
+                case "directoryRead":
+                    return over(r.rule) || over(r.directory);
+                default:
+                    throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(r)}`);
+            }
+        });
+    }
+    static ruleOfferDerivedFactsAgree(offer) {
+        const derive = (rule) => {
+            const p = parseAllowRuleText(rule);
+            return "rule" in p ? p.rule : undefined;
+        };
+        if (offer.kind === "single") {
+            const d = derive(offer.rule);
+            return d !== undefined && d.rule === offer.rule && d.tool === "Bash" && d.match === offer.match && d.command === offer.command;
+        }
+        return offer.rules.every((m) => {
+            const d = derive(m.rule);
+            if (d === undefined || d.rule !== m.rule)
+                return false;
+            switch (m.kind) {
+                case "command":
+                    return d.tool === "Bash" && d.match === m.match && d.command === m.command;
+                case "directoryRead":
+                    return d.tool === "Read" && d.match === "subpath" && d.command === m.directory;
+                default:
+                    throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(m)}`);
+            }
+        });
+    }
     static boundRuleOfferTexts(offers) {
         const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
+        const clipSegment = (s) => (over(s) ? s.slice(0, MAX_RULE_TEXT_CHARS) : s);
         const out = [];
-        for (const offer of offers) {
+        for (const raw of offers) {
+            const parsed = RuleOfferRawSchema.safeParse(screenUncoveredDetailSeat(backfillLegacyBatchMemberKind(raw)));
+            if (!parsed.success) {
+                defaultLogger.warn("rule_offer_dropped_unreadable_shape", {
+                    kind: typeof raw === "object" && raw !== null ? String(raw.kind) : typeof raw,
+                    note: "this offer's shape is outside the closed vocabulary this build reads (member kind / match / reason) — dropped whole; sibling offers still render (core/dist skew?)",
+                });
+                continue;
+            }
+            const offer = parsed.data;
+            if (ToolApprovalCoordinator.ruleOfferTextsOverSize(offer))
+                return undefined;
+            if (!ToolApprovalCoordinator.ruleOfferDerivedFactsAgree(offer)) {
+                defaultLogger.warn("rule_offer_dropped_derived_facts_disagree", {
+                    kind: offer.kind,
+                    note: "an offer's kind/match/command/directory seats do not agree with what the shared validator derives from its rule text — dropped whole so the card never shows one grant while redeeming another (core/dist skew or forged material?)",
+                });
+                continue;
+            }
             switch (offer.kind) {
                 case "single":
-                    if (over(offer.rule) || over(offer.command))
-                        return undefined;
-                    out.push(offer);
+                    out.push({ kind: "single", rule: offer.rule, match: offer.match, command: offer.command });
                     break;
-                case "batch":
-                    if (offer.rules.some((r) => over(r.rule) || over(r.command)))
-                        return undefined;
+                case "batch": {
+                    const rules = [];
+                    for (const r of offer.rules) {
+                        switch (r.kind) {
+                            case "command":
+                                rules.push({ kind: "command", rule: r.rule, match: r.match, command: r.command, segment: clipSegment(r.segment) });
+                                break;
+                            case "directoryRead":
+                                rules.push({ kind: "directoryRead", rule: r.rule, directory: r.directory, segment: clipSegment(r.segment) });
+                                break;
+                            default:
+                                throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(r)}`);
+                        }
+                    }
                     out.push({
                         kind: "batch",
-                        rules: offer.rules.map((r) => (over(r.segment) ? { ...r, segment: r.segment.slice(0, MAX_RULE_TEXT_CHARS) } : r)),
+                        rules,
                         uncoveredSegments: offer.uncoveredSegments,
+                        ...(offer.uncoveredDetail !== undefined ? { uncoveredDetail: offer.uncoveredDetail.map((d) => ({ segment: clipSegment(d.segment), reason: d.reason })) } : {}),
                     });
                     break;
+                }
                 default:
-                    return undefined;
+                    throw new Error(`unknown rule-offer kind: ${JSON.stringify(offer)}`);
             }
         }
         return out;
@@ -504,10 +585,10 @@ export class ToolApprovalCoordinator {
             return { kind: "none" };
         return { kind: "row", current: projectAskTerminalClaimTruth(row) };
     }
-    classifyClaimLoss(askId, current, where) {
+    classifyClaimLoss(askId, current, _where) {
         if (current.state === "absent")
             return { kind: "absent" };
-        const replayed = settleArgsOf(this.guardRowDerivedApprove(askId, replayTerminalAskRow(current), where));
+        const replayed = settleArgsOf(replayTerminalAskRow(current));
         if (replayed === "unavailable")
             return { kind: "parked" };
         if (!replayed.allowed)
@@ -608,10 +689,6 @@ export class ToolApprovalCoordinator {
         const entries = this.pendingByAskId.get(askId);
         if (!entries)
             return { settled: 0 };
-        if (allowed && updatedInput === undefined) {
-            if (this.guardRowDerivedApprove(askId, true, "notify-external-decision") === "unavailable")
-                return { settled: 0 };
-        }
         let settled = 0;
         for (const entry of [...entries]) {
             entry.settle(allowed, allowed ? "allowed" : "denied", updatedInput);
@@ -820,7 +897,7 @@ export class ToolApprovalCoordinator {
                 });
                 if (existingOrCreated.row.state !== "STREAM_PENDING") {
                     releaseAdmission();
-                    const replayed = this.guardRowDerivedApprove(askId, replayTerminalAskRow(existingOrCreated.row), "ensure-ask-idempotent-replay");
+                    const replayed = replayTerminalAskRow(existingOrCreated.row);
                     return replayed === "unavailable" ? this.unattendedOutcome() : replayed;
                 }
                 const persistedEnvelope = ApprovalCardEnvelopeSchema.safeParse(existingOrCreated.row.cardJson);
@@ -1859,6 +1936,7 @@ export class ToolApprovalCoordinator {
         for (const [id, e] of this.pending) {
             if (scope !== undefined && e.owner !== scope)
                 continue;
+            const contentKind = contentKindOf(e.toolName);
             rows.push({
                 approvalId: id,
                 toolName: e.toolName,
@@ -1868,6 +1946,7 @@ export class ToolApprovalCoordinator {
                 ...(e.requiresRealApproval ? { requiresRealApproval: true } : {}),
                 ...(e.governanceForced ? { governanceForced: true } : {}),
                 ...(e.originTaskId !== undefined ? { fromSubagent: true, originTaskId: e.originTaskId } : {}),
+                ...(contentKind !== undefined ? { contentKind } : {}),
             });
         }
         return rows;
@@ -1932,13 +2011,6 @@ export class ToolApprovalCoordinator {
         }
         return { polled, settled, backlog, truncated };
     }
-    liveConsumerCount(askId) {
-        let n = 0;
-        for (const e of this.pendingByAskId.get(askId) ?? [])
-            if (e.settledOutcome === undefined)
-                n++;
-        return n;
-    }
     markEditedDecisionInFlight(askId) {
         this.editedDecisionsInFlight.set(askId, (this.editedDecisionsInFlight.get(askId) ?? 0) + 1);
         let released = false;
@@ -1957,12 +2029,6 @@ export class ToolApprovalCoordinator {
             if (released)
                 return;
             defaultLogger.warn("approval_edited_decision_mark_expired", { askId, capMs: EDITED_DECISION_MARK_CAP_MS });
-            this.abandonedEditedDecisions.set(askId, Date.now() + ABANDONED_EDIT_TOMBSTONE_TTL_MS);
-            if (this.abandonedEditedDecisions.size > ABANDONED_EDIT_TOMBSTONE_MAX) {
-                const oldest = this.abandonedEditedDecisions.keys().next();
-                if (!oldest.done)
-                    this.dropAbandonedEditTombstone(oldest.value, "capacity");
-            }
             drop();
         }, EDITED_DECISION_MARK_CAP_MS);
         watchdog.unref?.();
@@ -1974,47 +2040,9 @@ export class ToolApprovalCoordinator {
     editedDecisionInFlight(askId) {
         return (this.editedDecisionsInFlight.get(askId) ?? 0) > 0;
     }
-    abandonedEditedDecisionPending(askId) {
-        const until = this.abandonedEditedDecisions.get(askId);
-        if (until === undefined)
-            return false;
-        if (Date.now() > until) {
-            this.dropAbandonedEditTombstone(askId, "ttl");
-            return true;
-        }
-        return true;
-    }
-    guardRowDerivedApprove(askId, outcome, where) {
-        if (outcome !== true || askId === undefined)
-            return outcome;
-        if (!this.abandonedEditedDecisionPending(askId))
-            return outcome;
-        defaultLogger.warn("approval_row_derived_approve_parked_after_abandoned_edit", { askId, where });
-        this.settleSameAskIdParkRoute(askId);
-        return "unavailable";
-    }
-    dropAbandonedEditTombstone(askId, why) {
-        const stillWaiting = this.liveConsumerCount(askId);
-        if (stillWaiting > 0) {
-            defaultLogger.warn("approval_abandoned_edit_tombstone_dropped_parking_consumers", { askId, why, parked: stillWaiting });
-            this.settleSameAskIdParkRoute(askId);
-        }
-        this.abandonedEditedDecisions.delete(askId);
-    }
     expireEditedDecisionMarkForTest(askId) {
-        this.abandonedEditedDecisions.set(askId, Date.now() + ABANDONED_EDIT_TOMBSTONE_TTL_MS);
         this.editedDecisionsInFlight.delete(askId);
     }
-    forceAbandonedEditTombstoneExpiryForTest(askId) {
-        if (!this.abandonedEditedDecisions.has(askId))
-            return;
-        this.abandonedEditedDecisions.set(askId, Date.now() - 1);
-        this.abandonedEditedDecisionPending(askId);
-    }
-    setAbandonedEditTombstoneDeadlineForTest(askId, atMs) {
-        if (this.abandonedEditedDecisions.has(askId))
-            this.abandonedEditedDecisions.set(askId, atMs);
-    }
     pendingCount() {
         return this.pending.size;
     }

package/dist/trace/core-keyset-guard.d.ts

@@ -20,7 +20,7 @@
 import type { TaskNotificationPayload, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxStore, TaskSpec, TaskResult } from "@sema-agent/core";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。 */
 type AssertAllKeysHandled<T extends never> = T;
-type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure";
+type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure" | "agentMessage" | "_sema_provenance";
 type NotificationExcluded = "peer";
 type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected | NotificationExcluded>>;
 type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId";
@@ -29,7 +29,7 @@ type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, Bg
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval";
-type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld";
+type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;

package/dist/trace/ledger-sink.d.ts

@@ -58,8 +58,14 @@ export interface LedgerSink {
     onForwardEvent(e: {
         type?: string;
     }): void;
-    /** Park event (durable F4 suspend / [ref] D-B review pause): ONLY the non-secret `checkpointGate` is
-     *  persisted — never the capability `checkpointToken` (search [18] Q1b). */
+    /** Park event (durable F4 suspend / [ref] D-B review pause): ONLY the `checkpointGate` is persisted —
+     *  never the capability `checkpointToken` (search [18] Q1b).
+     *  ⚠️ **"non-secret" was the old wording and it is not true** ([ref] R3, 2026-09-03 — wording only, behaviour
+     *  unchanged; [ref] decides the arm): the gate carries NO capability token, but its `riskDescriptor.summary` /
+     *  `shadowedRule` are model-/human-controlled display text that [ref] measured carrying a PEM private-key
+     *  body verbatim. This durable row replays on every `GET /v1/runs/:id/events` reconnect and is NOT backfilled
+     *  by core [ref]'s mint-point fix — it is the third face of the `checkpointGate` sister item recorded in
+     *  `http/routes/approvals-assistant.ts` (`redactPendingDisclosures` header). */
     appendParked(kind: "suspended" | "needs_review", result: unknown): Promise<void>;
     /** Terminal `done` event. `result` must already be checkpoint-token-stripped (and, on the bg leg,
      *  model-usage-attached) by the caller. */
@@ -101,7 +107,10 @@ export declare function createLedgerSink(opts: {
      *  ——**text_delta/reasoning_delta 只进内存缓冲、到 flush 边界才 append**(codex S1-F1,2026-08-13:
      *  只打 append 会让长时间流式输出被误读成「无进展」,方向与本键的设计目的正好相反);②`append`
      *  入口——兜住不经 onEvent 的直写路径(appendParked/appendDone/onForwardEvent)。分诊提示性回调:
-     *  抛错不得断链(打点失败丢的只是判别材料,账本不能陪葬)。 */
-    onActivity?: () => void;
+     *  抛错不得断链(打点失败丢的只是判别材料,账本不能陪葬)。
+     *  🔴 [ref] 件3:回调带**事件类型**(`kind`)——`cancelContext.lastEventKind` 的数据源。两个打点位
+     *  各传自己看得见的那个词(位①=流事件 `ev.type`,位②=账本行 `type`);拿不到类型的打点方
+     *  (core 的 onActivity 第五席、resume 腿手动打点)省参,`kind` 诚实缺席(见 turn-activity.ts)。 */
+    onActivity?: (kind?: string, statusData?: Record<string, unknown>) => void;
 }): LedgerSink;
 //# sourceMappingURL=ledger-sink.d.ts.map

package/dist/trace/ledger-sink.js

@@ -17,15 +17,15 @@ export function createLedgerSink(opts) {
     let text = "";
     let reasoning = "";
     let textEventId;
-    const beat = () => {
+    const beat = (kind, statusData) => {
         try {
-            opts.onActivity?.();
+            opts.onActivity?.(kind, statusData);
         }
         catch {
         }
     };
     const append = (type, data) => {
-        beat();
+        beat(type);
         const step = chain.then(() => opts.appendEvent(++seq, type, data));
         chain = step.then(() => undefined, () => undefined);
         return step;
@@ -41,7 +41,7 @@ export function createLedgerSink(opts) {
         }
     };
     const onEvent = async (ev) => {
-        beat();
+        beat(ev.type);
         switch (ev.type) {
             case "text_delta": {
                 const td = ev;
@@ -63,7 +63,11 @@ export function createLedgerSink(opts) {
                 break;
             case "status":
                 await flush();
-                await append("status", brainStatusEventData(ev));
+                {
+                    const statusData = brainStatusEventData(ev);
+                    beat("status", statusData);
+                    await append("status", statusData);
+                }
                 break;
             case "context_usage":
                 await flush();
@@ -134,7 +138,11 @@ export function createLedgerSink(opts) {
             void append("tool_end", toolEndEventData(e)).catch(() => undefined);
         }
     };
-    const appendStatus = (ev) => append("status", brainStatusEventData(ev));
+    const appendStatus = (ev) => {
+        const statusData = brainStatusEventData(ev);
+        beat("status", statusData);
+        return append("status", statusData);
+    };
     const appendParked = (kind, result) => append(kind, {
         gate: result?.checkpointGate ?? null,
         ...(typeof result?.toolCallId === "string" ? { toolCallId: result.toolCallId } : {}),

package/dist/trace/project.d.ts

@@ -16,6 +16,7 @@ import type { ApprovalSettledBy, TaskResult, SystemInjectionPriority } from "@se
 import { type AskDenyResolution } from "@sema-agent/core";
 import type { RunEvent, RunRecord } from "../plugins/store-contracts.js";
 import type { ModelUsageDelta, ModelUsageTracker, PromptManifestRecord } from "../budget.js";
+import { type SemaProvenanceInput } from "./sema-provenance.js";
 import type { LedgerEventType } from "./ledger-events.js";
 /** 账本写口的统一签名 —— `type` 是**闭集**(`ledger-events.ts`):新型必须先登记,否则调用点编译红
  *  (codex 交叉复审 F2:别名门 `ap("x")` 与动态首参让纯词法门结构性抓不全)。 */
@@ -214,6 +215,18 @@ export declare function taskNotificationEventData(ev: {
             status?: number;
             requestId?: string;
         };
+        /** [ref](a) [ref] 片6 d1(core 7.2.0):子代→主代 uplink 帧的**渲染判别**成员。在场 = 这一帧是
+         *  `SendMessage("main")` 的 agent-message(cli 渲 agent-message 卡;父模型面读的是顶层 `<agent-message from=…>`
+         *  帧而非 task-notification 外壳);缺席 = 老形卡。`body` 是子代文本 = UNTRUSTED(与 `result` 同姿势 redact);
+         *  `from` 是 core 铸的发送方标签(引擎值,verbatim)。铸造点唯一:core `agents/send-message-tool.ts` uplink 腿。 */
+        agentMessage?: {
+            from: string;
+            body: string;
+        };
+        /** 同批:typed 归因侧记(wire 键;core 契约「a host projects it, the model never sees it」)。成员逐个挑取,
+         *  `kind` 过闭集(`trace/sema-provenance.ts` 单点,park 半场同一判据);`agentType` 本 mount 恒缺席(工具无
+         *  agent-type 席),在场即透传(fleet spawn 帧按 taskId 可 join 时上游给)。 */
+        _sema_provenance?: SemaProvenanceInput;
     };
     eventId?: string;
     parentToolCallId?: string;

package/dist/trace/project.js

@@ -1,6 +1,8 @@
+import { redactErrorMessage } from "../observability/run-terminal-log.js";
 import { isApprovalSettledBy, isAskDenyResolution } from "@sema-agent/core";
 import { redactSecrets, redactDeep } from "./redact.js";
 import { injectionTierOrAbsent } from "./injection-tier.js";
+import { semaProvenanceOrAbsent } from "./sema-provenance.js";
 export async function appendModelUsageDelta(append, modelUsage, taskId) {
     const delta = modelUsage?.drain(taskId);
     if (delta) {
@@ -151,6 +153,13 @@ export function taskNotificationEventData(ev) {
         ...(n.result !== undefined ? { result: redactSecrets(n.result) } : {}),
         ...(n.output_file !== undefined ? { output_file: redactSecrets(n.output_file) } : {}),
         ...(n.usage !== undefined ? { usage: n.usage } : {}),
+        ...(n.agentMessage !== undefined ? { agentMessage: { from: n.agentMessage.from, body: redactSecrets(n.agentMessage.body) } } : {}),
+        ...(() => {
+            if (n._sema_provenance === undefined)
+                return {};
+            const p = semaProvenanceOrAbsent(n._sema_provenance);
+            return p !== undefined ? { _sema_provenance: p } : {};
+        })(),
         ...(() => {
             const tier = injectionTierOrAbsent(ev.priority);
             return tier !== undefined ? { priority: tier } : {};
@@ -522,7 +531,7 @@ function mapTraceEventInner(type, seq, data) {
         case "needs_review":
             return { event: "done", data: { seq, suspended: true } };
         case "failed":
-            return { event: "error", data: { type: "error", errorCode: "WORKER_DOWN", message: redactSecrets(String(data.errorMessage ?? "run failed")) } };
+            return { event: "error", data: { type: "error", errorCode: "WORKER_DOWN", message: redactErrorMessage(String(data.errorMessage ?? "run failed")) ?? "run failed" } };
         case "context_usage":
         case "compaction_outcome":
         case "wiring_manifest":