@sema-agent/server 7.68.0 → 7.69.0

package/dist/parked-decide.js

@@ -1,5 +1,45 @@
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
 import { backgroundScopesForCheckpointScope, decodeCheckpointScope } from "./security.js";
+export async function findParkOrigin(sources, cp) {
+    if (sources.agentStore !== undefined) {
+        let match;
+        try {
+            match = await findParkedAgentForCheckpoint(sources.agentStore, cp);
+        }
+        catch (e) {
+            quiet(sources.warn, "parked_decide_probe_failed", { error: e instanceof Error ? e.message : String(e) });
+        }
+        if (match !== undefined)
+            return { kind: "background", handle: match.handle, row: match.row };
+    }
+    const index = sources.workflowIndex;
+    const runStore = sources.workflowRunStore;
+    if (index === undefined || runStore === undefined)
+        return undefined;
+    try {
+        const row = await index.findByAgentSession(cp.sessionId);
+        if (row === null)
+            return undefined;
+        const run = await runStore.get(row.runId);
+        if (run === null)
+            return undefined;
+        const agent = (run.agents ?? []).find((a) => a.sessionId === cp.sessionId && a.status === "parked");
+        if (agent === undefined || agent.parkedCheckpointToken !== cp.token)
+            return undefined;
+        return { kind: "workflow", runId: row.runId, run, agent };
+    }
+    catch (e) {
+        quiet(sources.warn, "workflow_park_probe_failed", { error: e instanceof Error ? e.message : String(e) });
+        return undefined;
+    }
+}
+function quiet(warn, event, fields) {
+    try {
+        warn?.(event, fields);
+    }
+    catch {
+    }
+}
 export async function findParkedAgentForCheckpoint(agentStore, cp) {
     for (const scope of backgroundScopesForCheckpointScope(cp.scope)) {
         const parked = await agentStore.listByScope(scope, { status: "parked" });
@@ -25,21 +65,61 @@ function mintReviveArgs(row, knownAgentTypes) {
         ...(row.agentType !== undefined && knownAgentTypes.has(row.agentType) ? { subagent_type: row.agentType } : {}),
     };
 }
-export async function decideParkedAgent(deps, req) {
-    let match;
-    try {
-        match = await findParkedAgentForCheckpoint(deps.agentStore, { token: req.token, scope: req.scope, sessionId: req.sessionId });
+export function buildParkedResumeOutcome(req) {
+    const pa = req.pendingAction;
+    const persistedCallId = pa?.kind === "tool_approval" ? (pa.toolCallId ?? "") : "";
+    const persistedHash = pa?.kind === "tool_approval" ? (pa.boundInputHash ?? "") : "";
+    return {
+        gate: "policy_ask",
+        boundCallId: req.binding?.boundCallId ?? persistedCallId,
+        boundInputHash: req.binding?.boundInputHash ?? persistedHash,
+        decision: req.decision === "approve" ? "allow" : "deny",
+        ...(req.decision === "approve" && req.binding?.updatedInput !== undefined ? { updatedInput: req.binding.updatedInput } : {}),
+        ...(req.answer !== undefined ? { answer: req.answer } : {}),
+        ...(req.reason !== undefined ? { reason: req.reason } : {}),
+        hostDecision: req.hostDecision,
+    };
+}
+export function planWorkflowParkedDecide(origin, req) {
+    if (req.grantRemember !== undefined) {
+        return {
+            ok: false,
+            deny: {
+                status: 400,
+                body: {
+                    error: "remember:\"session\" is not supported for a parked WORKFLOW agent: this lane's 200 means the decision was handed to the host's next turn, not that the engine committed it — an exemption granted here could outlive a decision the engine later rejects. Re-issue the decide without `remember`.",
+                    errorCode: "decide.workflow_remember_unsupported",
+                    runId: origin.runId,
+                },
+            },
+        };
     }
-    catch (e) {
-        try {
-            deps.warn?.("parked_decide_probe_failed", { error: e instanceof Error ? e.message : String(e) });
-        }
-        catch {
-        }
-        return undefined;
+    const hostSessionId = origin.run.originatingSessionId;
+    if (hostSessionId === undefined || hostSessionId === "") {
+        return {
+            ok: false,
+            deny: {
+                status: 409,
+                body: {
+                    error: "this parked workflow agent's run carries no originating session — the deployment has nowhere to deliver the decision (a directly-started workflow, not a Workflow tool call)",
+                    errorCode: "decide.workflow_host_unknown",
+                    runId: origin.runId,
+                },
+            },
+        };
     }
-    if (match === undefined)
-        return undefined;
+    const verdict = req.decision === "approve" ? "APPROVED" : "DENIED";
+    return {
+        ok: true,
+        hostSessionId,
+        runId: origin.runId,
+        outcome: buildParkedResumeOutcome(req),
+        message: `The human approval that workflow run "${origin.runId}" parked on (agent callKey "${origin.agent.callKey}") has been ${verdict}. ` +
+            `Resume that run now by calling Workflow with resumeFromRunId: "${origin.runId}" — the decision is already held by the deployment ` +
+            `and will be applied to the parked agent; completed steps replay from the journal. Do not re-issue the original call.`,
+    };
+}
+export async function decideParkedAgent(deps, req, match) {
     const row = match.row;
     const rememberRoot = req.grantRemember !== undefined ? (row.rootSessionId ?? row.parentSessionId) : undefined;
     if (req.grantRemember !== undefined && rememberRoot === undefined) {
@@ -81,19 +161,7 @@ export async function decideParkedAgent(deps, req) {
         catch {
         }
     }
-    const pa = req.pendingAction;
-    const persistedCallId = pa?.kind === "tool_approval" ? (pa.toolCallId ?? "") : "";
-    const persistedHash = pa?.kind === "tool_approval" ? (pa.boundInputHash ?? "") : "";
-    const outcome = {
-        gate: "policy_ask",
-        boundCallId: req.binding?.boundCallId ?? persistedCallId,
-        boundInputHash: req.binding?.boundInputHash ?? persistedHash,
-        decision: req.decision === "approve" ? "allow" : "deny",
-        ...(req.decision === "approve" && req.binding?.updatedInput !== undefined ? { updatedInput: req.binding.updatedInput } : {}),
-        ...(req.answer !== undefined ? { answer: req.answer } : {}),
-        ...(req.reason !== undefined ? { reason: req.reason } : {}),
-        hostDecision: req.hostDecision,
-    };
+    const outcome = buildParkedResumeOutcome(req);
     const ctx = {
         toolCallId: `drv-${ticket.claimId}`,
         reviveClaim: {

package/dist/plugins/pg-pool.js

@@ -266,6 +266,14 @@ export const PG_SCHEMA_STATEMENTS = [
    )`,
     `CREATE INDEX IF NOT EXISTS idx_wfrun_scope_created ON workflow_run (scope, created_at_ms)`,
     `CREATE INDEX IF NOT EXISTS idx_wfrun_scope_status ON workflow_run (scope, status)`,
+    `CREATE TABLE IF NOT EXISTS workflow_agent_session (
+     session_id VARCHAR(190) COLLATE "C" NOT NULL,
+     run_id     VARCHAR(191) COLLATE "C" NOT NULL,
+     agent_key  VARCHAR(191) COLLATE "C" NOT NULL,
+     scope      VARCHAR(190) COLLATE "C" NOT NULL,
+     PRIMARY KEY (session_id)
+   )`,
+    `CREATE INDEX IF NOT EXISTS idx_wfagentsess_run ON workflow_agent_session (run_id)`,
     `CREATE TABLE IF NOT EXISTS workflow_completion_inbox (
      seq            BIGSERIAL,
      session_id     VARCHAR(190) COLLATE "C" NOT NULL,

package/dist/plugins/store-backend.d.ts

@@ -238,6 +238,11 @@ export interface StoreBackend {
     /** 1.108 review fix (lens③ HIGH): the notify-JOURNAL twin — third leg of the same axis (a SQL run store +
      *  inbox with a replica-LOCAL File journal stranded a dead replica's un-acked notify forever). */
     notifyJournal?(): import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore;
+    /** S-185 车CM:workflow 出身 park 的**有界 join** 索引(子会话 id → 它所属的 workflow run)。
+     *  与 `workflowRun`/`completionInbox`/`notifyJournal` 同一条轴 —— SQL 后端 = 跨副本双生;`local` 车道
+     *  缺席**是一个真答案**:那里的索引家在 run 店同一间屋子里(`LocalWorkflowAgentSessionIndex`,文件账本
+     *  或纯内存),不需要经过 backend。契约与单写者纪律的属主 = orchestration/workflow-agent-session-index.ts。 */
+    workflowAgentSessionIndex?(): import("../orchestration/workflow-agent-session-index.js").WorkflowAgentSessionIndex;
     /** Cloud-only stores below are OPTIONAL: the `local` (in-memory/file) backend omits them (it has no core
      *  in-memory twin carrying the service extras, and these are fleet/multi-replica concepts), so a local HTTP
      *  service degrades EXACTLY like today's no-DB env (the consumers gate on `backend?.X?.()`). TiDB/PG provide all. */

package/dist/plugins/store-backend.js

@@ -4,7 +4,7 @@ import { AdoptionError, FileStorageBackend, FileSessionRepo } from "@sema-agent/
 import { FileWorkflowJournalStore } from "@sema-agent/core";
 import { TiDBOutcomeLedger, PgOutcomeLedger } from "./outcome-ledger-sql.js";
 import { FileOutcomeSink } from "./file-outcome-sink.js";
-import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore, PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore } from "./workflow-run-store-sql.js";
+import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore, TiDBWorkflowAgentSessionIndex, PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore, PgWorkflowAgentSessionIndex } from "./workflow-run-store-sql.js";
 import { FileRunStore, RunStoreStrictHydrateError } from "./file-run-store.js";
 import { LocalSessionStore } from "./local-session-store.js";
 import { LocalCheckpointStore } from "./local-checkpoint-store.js";
@@ -145,6 +145,7 @@ class TiDBBackend {
     workflowRun(onWarn) { return new TiDBWorkflowRunStore(this.pool, onWarn); }
     completionInbox(onWarn) { return new TiDBWorkflowCompletionInbox(this.pool, onWarn); }
     notifyJournal() { return new TiDBWorkflowNotifyJournalStore(this.pool); }
+    workflowAgentSessionIndex() { return new TiDBWorkflowAgentSessionIndex(this.pool); }
     sharedMemoryStore(authorizer) { return new TiDBSharedMemoryStore(this.pool, authorizer); }
     checkpoint(logger) { return new TiDBCheckpointStore(this.pool, logger); }
     toolResult() { return new TiDBToolResultStore(this.pool); }
@@ -191,6 +192,7 @@ class PgBackend {
     workflowRun(onWarn) { return new PgWorkflowRunStore(this.pool, onWarn); }
     completionInbox(onWarn) { return new PgWorkflowCompletionInbox(this.pool, onWarn); }
     notifyJournal() { return new PgWorkflowNotifyJournalStore(this.pool); }
+    workflowAgentSessionIndex() { return new PgWorkflowAgentSessionIndex(this.pool); }
     sharedMemoryStore(authorizer) { return new PgSharedMemoryStore(this.pool, authorizer); }
     checkpoint(logger) { return new PgCheckpointStore(this.pool, logger); }
     toolResult() { return new PgToolResultStore(this.pool); }

package/dist/plugins/tidb-pool.js

@@ -446,6 +446,14 @@ export const SCHEMA_STATEMENTS = [
      PRIMARY KEY (id),
      KEY idx_wfrun_scope_created (scope, created_at_ms),
      KEY idx_wfrun_scope_status (scope, status)
+   ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS workflow_agent_session (
+     session_id VARCHAR(190) NOT NULL,
+     run_id     VARCHAR(191) NOT NULL,
+     agent_key  VARCHAR(191) NOT NULL,
+     scope      VARCHAR(190) NOT NULL,
+     PRIMARY KEY (session_id),
+     KEY idx_wfagentsess_run (run_id)
    ) COLLATE utf8mb4_bin`,
     `CREATE TABLE IF NOT EXISTS workflow_completion_inbox (
      seq            BIGINT       NOT NULL AUTO_INCREMENT,

package/dist/plugins/workflow-journal-store-sql.js

@@ -1,5 +1,6 @@
 import { callKeyOrdinal } from "@sema-agent/core";
 import { oversizeJournalResult } from "@sema-agent/core";
+import { journalEntryOfRow, journalEntryPayload, journalRowPayloadOf } from "../orchestration/workflow-journal-entry.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 const DEFAULT_RESUME_CLAIM_TTL_MS = 60 * 60 * 1000;
 export class SqlWorkflowJournalStore {
@@ -13,16 +14,22 @@ export class SqlWorkflowJournalStore {
         return this.db.dialect === "tidb" ? tidb : pg;
     }
     async append(runId, scope, entry) {
-        const serialized = JSON.stringify(entry.result);
-        if (oversizeJournalResult(serialized))
+        const serialized = journalRowPayloadOf(entry);
+        if (oversizeJournalResult(serialized)) {
+            if (journalEntryPayload(entry).parked) {
+                throw new Error(`workflow journal: PARKED entry ${entry.callKey} is ${serialized.length} bytes, over the journal result cap — refusing to skip it. ` +
+                    "Skipping a parked entry would make a resume start a SECOND live agent beside the session already pinned by the pending checkpoint (duplicating pre-approval side effects); " +
+                    "a completed result may be skipped (resume just re-runs that agent), a park may not.");
+            }
             return;
+        }
         await this.db.query(this.q("INSERT INTO workflow_journal (run_id, ordinal, scope, call_key, result, created_at_ms) VALUES (?,?,?,?,?,?) " +
             "ON DUPLICATE KEY UPDATE call_key = VALUES(call_key), result = VALUES(result)", "INSERT INTO workflow_journal (run_id, ordinal, scope, call_key, result, created_at_ms) VALUES ($1,$2,$3,$4,$5,$6) " +
             "ON CONFLICT (run_id, ordinal) DO UPDATE SET call_key = EXCLUDED.call_key, result = EXCLUDED.result"), [runId, callKeyOrdinal(entry.callKey), scope, entry.callKey, serialized, Date.now()]);
     }
     async load(runId, scope) {
         const { rows } = await this.db.query(this.q("SELECT call_key, result FROM workflow_journal WHERE run_id = ? AND scope = ? ORDER BY ordinal ASC", "SELECT call_key, result FROM workflow_journal WHERE run_id = $1 AND scope = $2 ORDER BY ordinal ASC"), [runId, scope]);
-        return rows.map((r) => ({ callKey: String(r.call_key), result: JSON.parse(String(r.result)) }));
+        return rows.map((r) => journalEntryOfRow(String(r.call_key), String(r.result)));
     }
     locator(runId, _scope) {
         return `/v1/workflows/${runId}/journal`;

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -59,6 +59,7 @@ import type { Pool as PgPool } from "pg";
 import { summarizeWorkflowRun, type WorkflowRunStore } from "@sema-agent/core";
 import { type WorkflowCompletionInbox, type WorkflowCompletionInboxEntry } from "../orchestration/workflow-completion-inbox.js";
 import type { WorkflowNotifyJournalStore, WorkflowNotifyJournalEntry } from "../orchestration/workflow-notify-journal.js";
+import type { WorkflowAgentSessionIndex, WorkflowAgentSessionRow } from "../orchestration/workflow-agent-session-index.js";
 import { type SqlDriver } from "./sql-driver.js";
 type WorkflowRun = Parameters<WorkflowRunStore["put"]>[1];
 /** Row cap guard: a run blob beyond this is NOT stored on update (the prior revision stays) — TiDB's
@@ -153,6 +154,29 @@ export declare class SqlWorkflowNotifyJournalStore implements WorkflowNotifyJour
     reapAcked(before: number): Promise<number>;
     get(runId: string): Promise<WorkflowNotifyJournalEntry | null>;
 }
+/**
+ * S-185 车CM —— **workflow 出身 park 的有界 join 索引** SQL 双生(契约与纪律的唯一属主 =
+ * {@link import("../orchestration/workflow-agent-session-index.js").WorkflowAgentSessionIndex} 的文件头,
+ * 这里只记方言差)。行是 `WorkflowRun` 的派生投影,写者只有一个(Journaling 装饰器的写观察点)。
+ *
+ * ── 方言差,保持显式 ──────────────────────────────────────────────────────────────────────────
+ *   - `?` 占位 vs `$n`,且 `syncRun` 的删除腿在 PG 上要按 `params.length` 记位(与 `listByScope` 同因)。
+ *   - 「删掉这条 run 里已不在 rows 里的旧行」:TiDB `session_id NOT IN (?,?,…)`(动态占位数)vs
+ *     PG `session_id <> ALL($n::text[])`(数组绑定)—— 两边同一件事,语句结构不同(reap 的批删同先例)。
+ *   - upsert:TiDB `REPLACE INTO`(整行替换)vs PG `INSERT … ON CONFLICT (session_id) DO UPDATE`。
+ *   - schema 属主同店内其余表:TiDB DDL 在 tidb-pool.ts,PG DDL 在 pg-pool.ts(店不建表)。
+ *
+ * 🔴 **写序**:先 upsert 再删。反过来(先删后 upsert)会在两条语句之间留出一个**索引行不存在**的窗口,
+ * 而这期间进来的 `/decide` 会诚实 miss ⇒ 一次本可受理的批准被退回。先 upsert 的最坏形是窗口内多一条
+ * 旧行(读口按 session_id 精确查,取 run 后还要逐字比对赎回键 ⇒ 多余的行只会 miss,不会错配)。
+ */
+export declare class SqlWorkflowAgentSessionIndex implements WorkflowAgentSessionIndex {
+    private readonly db;
+    constructor(db: SqlDriver);
+    private q;
+    syncRun(runId: string, rows: readonly WorkflowAgentSessionRow[]): Promise<void>;
+    findByAgentSession(sessionId: string): Promise<WorkflowAgentSessionRow | null>;
+}
 /** MySQL-protocol (TiDB) bindings — historical class names preserved; `onWarn` is an ADDITIVE optional 2nd
  *  ctor arg (existing 1-arg call sites are unaffected — see {@link SqlWorkflowRunStore}'s C5 trace channel). */
 export declare class TiDBWorkflowRunStore extends SqlWorkflowRunStore {
@@ -175,5 +199,11 @@ export declare class PgWorkflowCompletionInbox extends SqlWorkflowCompletionInbo
 export declare class PgWorkflowNotifyJournalStore extends SqlWorkflowNotifyJournalStore {
     constructor(pool: PgPool);
 }
+export declare class TiDBWorkflowAgentSessionIndex extends SqlWorkflowAgentSessionIndex {
+    constructor(pool: MySqlPool);
+}
+export declare class PgWorkflowAgentSessionIndex extends SqlWorkflowAgentSessionIndex {
+    constructor(pool: PgPool);
+}
 export {};
 //# sourceMappingURL=workflow-run-store-sql.d.ts.map

package/dist/plugins/workflow-run-store-sql.js

@@ -277,6 +277,36 @@ export class SqlWorkflowNotifyJournalStore {
         };
     }
 }
+export class SqlWorkflowAgentSessionIndex {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    q(tidb, pg) {
+        return this.db.dialect === "tidb" ? tidb : pg;
+    }
+    async syncRun(runId, rows) {
+        for (const r of rows) {
+            await this.db.query(this.q("REPLACE INTO workflow_agent_session (session_id, run_id, agent_key, scope) VALUES (?,?,?,?)", `INSERT INTO workflow_agent_session (session_id, run_id, agent_key, scope) VALUES ($1,$2,$3,$4)
+             ON CONFLICT (session_id) DO UPDATE SET run_id = EXCLUDED.run_id, agent_key = EXCLUDED.agent_key, scope = EXCLUDED.scope`), [r.sessionId, r.runId, r.agentKey, r.scope]);
+        }
+        const keep = rows.map((r) => r.sessionId);
+        if (this.db.dialect === "tidb") {
+            const holes = keep.map(() => "?").join(",");
+            await this.db.query(`DELETE FROM workflow_agent_session WHERE run_id = ?${keep.length > 0 ? ` AND session_id NOT IN (${holes})` : ""}`, [runId, ...keep]);
+        }
+        else {
+            await this.db.query(`DELETE FROM workflow_agent_session WHERE run_id = $1${keep.length > 0 ? " AND session_id <> ALL($2::text[])" : ""}`, keep.length > 0 ? [runId, keep] : [runId]);
+        }
+    }
+    async findByAgentSession(sessionId) {
+        const { rows } = await this.db.query(this.q("SELECT session_id, run_id, agent_key, scope FROM workflow_agent_session WHERE session_id = ?", "SELECT session_id, run_id, agent_key, scope FROM workflow_agent_session WHERE session_id = $1"), [sessionId]);
+        const r = rows[0];
+        if (!r)
+            return null;
+        return { sessionId: String(r.session_id), runId: String(r.run_id), agentKey: String(r.agent_key), scope: String(r.scope) };
+    }
+}
 export class TiDBWorkflowRunStore extends SqlWorkflowRunStore {
     constructor(pool, onWarn) {
         super(mysqlDriver(pool), onWarn);
@@ -307,4 +337,14 @@ export class PgWorkflowNotifyJournalStore extends SqlWorkflowNotifyJournalStore
         super(pgDriver(pool));
     }
 }
+export class TiDBWorkflowAgentSessionIndex extends SqlWorkflowAgentSessionIndex {
+    constructor(pool) {
+        super(mysqlDriver(pool));
+    }
+}
+export class PgWorkflowAgentSessionIndex extends SqlWorkflowAgentSessionIndex {
+    constructor(pool) {
+        super(pgDriver(pool));
+    }
+}
 //# sourceMappingURL=workflow-run-store-sql.js.map

package/dist/router/route-orchestration.js

@@ -1,4 +1,5 @@
 import {} from "@sema-agent/core";
+import { operatorAsk } from "../operator-ask.js";
 export function routeOrchestration(s) {
     if (s.explicitMode)
         return { mode: s.explicitMode, reason: `explicit:${s.explicitMode}` };
@@ -40,7 +41,7 @@ export function isIsolatedExecEnv(provider, runtimeClass) {
 }
 const WRITE_HAND_TOOLS = new Set(["Edit", "Write", "NotebookEdit"]);
 export function supPostureOverrides() {
-    const ask = (toolName) => ({ action: "ask", message: `${toolName} gated by supervisor routing (capability-danger task)`, decisionReason: "rule" });
+    const ask = (toolName) => operatorAsk(`supervisor routing(capability-danger:${toolName})`, `${toolName} gated by supervisor routing (capability-danger task)`);
     const writeGate = {
         check: (req) => (WRITE_HAND_TOOLS.has(req.toolName) ? ask(req.toolName) : { action: "allow" }),
     };

package/dist/run-local.js

@@ -190,7 +190,7 @@ export async function runLocal(argv, deps = {}) {
                 config.mcpServers = resolveMcpServers(effective.mcp, logger);
             if (effective?.a2a)
                 config.a2aPeers = resolveA2aPeers(effective.a2a, logger);
-            applyCenterReadFace(config, r.effective, logger);
+            applyCenterReadFace(config, r.effective, logger, { phase: "boot" });
             logger.info("config_loaded", { source: configProvider.kind, version: r.effective.version });
         }
     }

package/dist/runs.js

@@ -88,6 +88,8 @@ export function resumeAtHttpStatus(result) {
         return 400;
     if (code === "config.invalid_checkpoint_store")
         return 400;
+    if (code === "config.tool_mount_denied")
+        return 400;
     if (code === "config.memory_capture_unsupported")
         return 409;
     if (!code.startsWith("resume_at."))

package/dist/runtime-governance.js

@@ -1,6 +1,7 @@
 import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
 import { SAFETY_MERGE_SPEC } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
+import { operatorAsk } from "./operator-ask.js";
 export function isDelegationToolName(name) {
     return name === DEFAULT_SUBAGENT_TOOL_NAME;
 }
@@ -13,18 +14,18 @@ export const COARSE_SHELL_TOOLS_MIRROR = COARSE_SHELL_TOOLS;
 function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
     const askSet = new Set(askCommands);
     const shellTools = new Set(tools);
-    const ask = (message) => ({ action: "ask", message, decisionReason: "rule" });
+    const ask = (message, rule) => operatorAsk(rule, message);
     return {
         check(req) {
             if (!shellTools.has(req.toolName))
                 return { action: "allow" };
             const command = req.args?.command;
             if (typeof command !== "string")
-                return ask(`tool "${req.toolName}" call has no parseable command string`);
+                return ask(`tool "${req.toolName}" call has no parseable command string`, "commandPolicy(unparseable command)");
             const parsed = parseLeadingCommandName(command);
             if ("reject" in parsed)
-                return ask(`command is not a single simple command (${parsed.reject})`);
-            return askSet.has(parsed.name) ? ask(`command "${parsed.name}" requires approval by policy`) : { action: "allow" };
+                return ask(`command is not a single simple command (${parsed.reject})`, "commandPolicy(argv[0] unparseable)");
+            return askSet.has(parsed.name) ? ask(`command "${parsed.name}" requires approval by policy`, `commandPolicy(${parsed.name}=ask)`) : { action: "allow" };
         },
     };
 }

package/dist/tool-approval.d.ts

@@ -143,6 +143,26 @@ export interface ToolApprovalFrame {
      * ask」,治理策略产的与普通策略产的在这一个词上同形 ⇒ 顶替不了(逐字论证见 `governance-ask-marks.ts` 顶注)。
      */
     origin?: string;
+    /**
+     * **S-185 / [ref]**(core 7.10.0;**ADDITIVE**,`"tool_approval"` only)—— 这一问**为什么**到了人手上:
+     * auto 档的分类器被咨询过、而它**跑不了**。`cause` = core 的闭三词
+     * (`AUTO_MODE_UNAVAILABLE_CAUSES` = `error` / `timeout` / `breaker_open`),`AskRequest.classifierUnavailable`
+     * 逐字透传。
+     *
+     * 🔴 **缺席 ≠「分类器好着呢」**:缺席同时覆盖三形 —— 分类器答上了 / 这只 ask 没资格走分类器
+     * (`classifierMayAnswer` 的闭表)/ 本部署压根没接分类器。消费端**禁**把缺席读成对分类器健康的断言。
+     * 另注:`parse_error`(分类器跑了但答得出格)**不盖这一位** —— 那是另一句话,core 顶注逐字。
+     *
+     * 🔴 **不枚举词表**(值形是 `{cause: string}` 而不是本仓自铸的联合):词表单一属主在 core,抄一份会把
+     * core 加的新词吞成缺席。窄读只判「对象 ∧ `cause` 非空串 ∧ 无多余成员」(`readClassifierUnavailable`,
+     * 帧与卡的**唯一**铸造点 ⇒ 两面结构性同值)。
+     *
+     * 🔴 **echo-only,零消费**:熔断/超时的处置全在 core 的分类器站,server 不许据本键自铸第二套回落判据
+     * —— 同 `origin` / `denialLimitFallback` 两条顶注的同一条禁令(同一语义面两个写者)。
+     */
+    classifierUnavailable?: {
+        cause: string;
+    };
     /**
      * **E-14**([ref]② Trojan Source 族;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**工具输入**
      * (`AskRequest.args`)里含 bidi 控制符(LRM/RLM、嵌入/覆写、隔离符;字符类属主 `text-bidi.ts`)。

package/dist/tool-approval.js

@@ -8,7 +8,7 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readRuleEvidence, readRuleOffersAbsence, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readClassifierUnavailable, readProbeCause, readRuleEvidence, readRuleOffersAbsence, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 const defaultLogger = createLogger();
@@ -844,6 +844,7 @@ export class ToolApprovalCoordinator {
             ...(ruleLaneMaterial !== undefined ? { ruleOffers: ruleLaneMaterial.offers } : {}),
             ...((a) => (a !== undefined ? { ruleOffersAbsence: a } : {}))(readRuleOffersAbsence(req)),
             ...((f) => (f !== undefined ? { denialLimitFallback: f } : {}))(readDenialLimitFallback(req)),
+            ...((c) => (c !== undefined ? { classifierUnavailable: c } : {}))(readClassifierUnavailable(req)),
             ...((c) => (c !== undefined ? { probeCause: c } : {}))(readProbeCause(req)),
             ...((c) => (c !== undefined ? { ruleEvidence: c } : {}))(readRuleEvidence(req)),
             ...(bounded.omitted ? { argsOmitted: true } : { args: bounded.args }),

package/dist/trace/core-keyset-guard.d.ts

@@ -28,7 +28,7 @@ type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "descripti
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "classifierUnavailable";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta";
@@ -38,14 +38,14 @@ type _GuardMailbox = AssertAllKeysHandled<Exclude<keyof MailboxMessage, MailboxP
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type PermissionTraceKind = Extract<TraceEvent["kind"], `permission.${string}`>;
-type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable";
+type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed";
 type PermissionTraceDropped = "permission.sandbox_admitted" | "permission.rule_sync_resurrected" | "permission.rule_sync_dropped" | "permission.org_snapshot_unavailable";
 type _GuardPermissionTrace = AssertAllKeysHandled<Exclude<PermissionTraceKind, PermissionTraceProjected | PermissionTraceDropped>>;
 type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTraceProjected | PermissionTraceDropped, PermissionTraceKind>>;
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "classifierUnavailable";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested";

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;

package/dist/trace/engine-notice-wire.js

@@ -21,6 +21,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "peer.idle_subscription",
     "classifier.denial_limit",
     "mcp.injection_dropped",
+    "delegation.ask_unresolvable",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.68.0",
+  "version": "7.69.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,8 +54,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.9.2",
-    "@sema-agent/settings-schema": "1.9.0",
+    "@sema-agent/core": "7.11.2",
+    "@sema-agent/settings-schema": "1.10.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",