@sema-agent/server 7.68.0 → 7.70.0

package/dist/observability/permission-rule-events.d.ts

@@ -0,0 +1,20 @@
+/** 计量面的 `event` 词表(顺序 = HELP 行里的出现顺序)。 */
+export declare const PERMISSION_RULE_EVENT_TABLE: readonly [{
+    readonly event: "persisted_rule_allowed";
+    readonly meaning: "a persisted allow rule authorized the call and nobody was asked";
+}, {
+    readonly event: "rule_store_unreadable";
+    readonly meaning: "the rule store failed to read, so the call was adjudicated with ZERO rules (expect an approval storm whose cause is the store, not the model)";
+}, {
+    readonly event: "read_only_allowed";
+    readonly meaning: "the engine's read-only shell verdict cleared an ask that was NOT an operator-written rule (core decisionReason \"read_only\"; an operator-declared ask carries matchedAskRule and is never cleared this way)";
+}];
+/** 词表里的一个词(闭集)。 */
+export type PermissionRuleEventWord = (typeof PERMISSION_RULE_EVENT_TABLE)[number]["event"];
+/** 这一帧是否进 `permission_rule_events_total`(判别式与词表同源,不再手抄第二串 `===`)。 */
+export declare function isPermissionRuleEventKind(kind: string): boolean;
+/** 帧名 → `event` 标签值。调用方须先过 {@link isPermissionRuleEventKind}。 */
+export declare function permissionRuleEventWordOf(kind: string): string;
+/** `/metrics` 的 HELP 行文案(从词表派生 —— 加词自动出现,不存在「第二份会漂的散文」)。 */
+export declare function buildPermissionRuleEventsHelp(): string;
+//# sourceMappingURL=permission-rule-events.d.ts.map

package/dist/observability/permission-rule-events.js

@@ -0,0 +1,28 @@
+const PERMISSION_TRACE_PREFIX = "permission.";
+export const PERMISSION_RULE_EVENT_TABLE = [
+    {
+        event: "persisted_rule_allowed",
+        meaning: "a persisted allow rule authorized the call and nobody was asked",
+    },
+    {
+        event: "rule_store_unreadable",
+        meaning: "the rule store failed to read, so the call was adjudicated with ZERO rules (expect an approval storm whose cause is the store, not the model)",
+    },
+    {
+        event: "read_only_allowed",
+        meaning: "the engine's read-only shell verdict cleared an ask that was NOT an operator-written rule (core decisionReason \"read_only\"; an operator-declared ask carries matchedAskRule and is never cleared this way)",
+    },
+];
+const PERMISSION_RULE_EVENT_KINDS = new Set(PERMISSION_RULE_EVENT_TABLE.map((r) => `${PERMISSION_TRACE_PREFIX}${r.event}`));
+export function isPermissionRuleEventKind(kind) {
+    return PERMISSION_RULE_EVENT_KINDS.has(kind);
+}
+export function permissionRuleEventWordOf(kind) {
+    return kind.slice(PERMISSION_TRACE_PREFIX.length);
+}
+export function buildPermissionRuleEventsHelp() {
+    return ("Permission allow-layer attribution events by event — the ONE answer to \"why was I not asked this time?\" (" +
+        PERMISSION_RULE_EVENT_TABLE.map((r) => `${r.event} = ${r.meaning}`).join("; ") +
+        ")");
+}
+//# sourceMappingURL=permission-rule-events.js.map

package/dist/observability/run-terminal-log.d.ts

@@ -52,26 +52,15 @@ export declare const REDACT_INPUT_CAP = 65536;
  *  脱敏**之后**按字节封顶(占位已替换完,切在占位中间不是泄漏)并带标记。 */
 export declare const REDACT_OUTPUT_MAX_BYTES = 65000;
 export declare function redactErrorMessage(raw: string | undefined): string | undefined;
-/**
- * 同口:终态 `result` 整块也持久化(`GET /v1/runs/:id` 直出),写入前把里面的**自由文本座**脱敏,其余键
- * 逐字不动;`undefined`/`null` 透传。
- *
- * 🔴 S-136(core 7.6.0 [ref] D-8):自由文本座**搬家了** —— 失败文案与阻塞理由从顶层平面键
- * (`errorMessage` / `blockedReason`)搬进因由 `terminal` 的两条臂(`failed.message` / `blocked.reason`)。
- * 本函数**两种形都认**,而这不是「兼容读臂」(codex 对抗复审 r1 [high],亲读验真后**改判**;首版删掉了旧键
- * 臂,那是错的):本函数是**读盘面**,而 `task_run.result` / `task_event(done).result` 里躺着 7.63.0 及以前
- * 写下的**真字节**,它们本来就是平面形。写口只剩因由一条(没有任何东西会再写出旧形),所以这里不存在
- * 「两个写者」;而不认旧形的代价是**可复现的凭据回放**:上线前落盘的原文经 `GET /v1/runs/:id/events` 重新
- * 明文外发(读面这一层纵深正是为那批行存在的)。⇒ 规则仍只有一条:**读盘认盘上真有的形,写盘只写一种形**。
- *
- * 读面也走本函数,所以 `terminal` 形上取 `unknown`:旧持久 blob 与非 core 的 Runner 实现给的形不可信,
- * 运行期逐臂判形、不抛(与 `remoteEnvFailures` / `editedFiles` 两座同款不信任)。
- */
+/** {@link redactTerminalResult} 会碰的全部顶层键 = 现行形的 `"redacted"` 行 ∪ 旧形平面键;
+ *  `memoRedactTerminalResult` 的记忆键由它派生(两处同源,见 `RESULT_KEY_TREATMENT` 顶注)。 */
+export declare const REDACTABLE_RESULT_LEAVES: readonly string[];
 export declare function redactTerminalResult<T extends {
     terminal?: unknown;
-    /** 旧形(≤7.63.0)的两个顶层自由文本座;形上取 `unknown` —— 读盘面对盘上字节不作假设。 */
+    /** 旧形(≤7.63.0)的三个顶层座;形上取 `unknown` —— 读盘面对盘上字节不作假设。 */
     errorMessage?: unknown;
     blockedReason?: unknown;
+    checkpointGate?: unknown;
     remoteEnvFailures?: readonly {
         message?: string | undefined;
     }[] | undefined;
@@ -94,9 +83,10 @@ export declare function redactWorkerReportError<T extends {
     error?: string | undefined;
     checkpointGate?: unknown;
 }>(report: T): T;
-/** codex r5 [high]:`WorkerReport.checkpointGate`(core `CheckpointGate`)整块随 LeaderResult 落库/直出——`reason` 与
- *  `riskDescriptor.summary`/`shadowedRule` 是自由文本([ref] 实测 summary 带 PEM 明文;[ref] R3 登记),按类型表脱这三叶;
- *  `kind`/`toolName`/`axes`/`severity`/`touchedPaths` 闭集或路径,逐字。非对象形原样返回。 */
+export declare function redactRiskDescriptor(rd: unknown): unknown;
+/** `CheckpointGate`(core 类型)整块上 wire —— `reason` 与 `riskDescriptor` 的叶族是自由文本
+ *  ([ref] 实测 summary 带 PEM 明文;[ref] R3 登记;[ref] 把它扩到结果/账本两面)。逐键**按表**处置,
+ *  叶表属主见 {@link redactRiskDescriptor}。非对象形原样返回(同一引用);字节没变也回同一引用。 */
 export declare function redactCheckpointGate(gate: unknown): unknown;
 /** 工件字节(patch / *.rej 拒绝块):codex r6 [high]——拒绝块能带 `git clone https://u:TOKEN@host` 或 `_authToken=` 行,
  *  「工件保真」不能让原凭据上元数据读面。做**原位密钥形替换**(与预览同一张规则表,字节只在密钥处变)、**不截断**;

package/dist/observability/run-terminal-log.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { redactSecrets } from "../trace/redact.js";
+import { isParkLedgerEventType } from "../trace/ledger-events.js";
 import { errorText } from "./err-text.js";
 import { recordFailOpen } from "./fail-open.js";
 const MESSAGE_CAP = 1024;
@@ -75,6 +76,37 @@ export function redactErrorMessage(raw) {
     }
 }
 const MAX_EDITED_FILES = 1000;
+const RESULT_KEY_TREATMENT = {
+    terminal: "redacted",
+    remoteEnvFailures: "redacted",
+    editedFiles: "redacted",
+    taskId: "verbatim",
+    runId: "verbatim",
+    sessionId: "verbatim",
+    model: "verbatim",
+    effectiveReasoning: "verbatim",
+    result: "verbatim",
+    salvagedOutput: "verbatim",
+    apiFailure: "verbatim",
+    retryAfterMs: "verbatim",
+    degraded: "verbatim",
+    structuredOutput: "verbatim",
+    rewindNotes: "verbatim",
+    haltedOnUserRejection: "verbatim",
+    haltedByUser: "verbatim",
+    strandedHumanAnswers: "verbatim",
+    pendingApproval: "verbatim",
+    approvalWaitedMs: "verbatim",
+    effectiveReadFace: "verbatim",
+    effectiveReadDenyPatterns: "verbatim",
+    effectiveMemoryScopes: "verbatim",
+    stats: "verbatim",
+};
+const LEGACY_RESULT_LEAVES = ["errorMessage", "blockedReason", "checkpointGate"];
+export const REDACTABLE_RESULT_LEAVES = [
+    ...Object.entries(RESULT_KEY_TREATMENT).filter(([, t]) => t === "redacted").map(([k]) => k),
+    ...LEGACY_RESULT_LEAVES,
+];
 export function redactTerminalResult(result) {
     if (result === undefined || result === null)
         return result;
@@ -89,14 +121,41 @@ export function redactTerminalResult(result) {
         out.blockedReason = redactErrorMessage(r.blockedReason);
         changed = true;
     }
+    if (r.checkpointGate !== undefined) {
+        const legacyGate = redactCheckpointGate(r.checkpointGate);
+        if (legacyGate !== r.checkpointGate) {
+            out.checkpointGate = legacyGate;
+            changed = true;
+        }
+    }
     if (r.terminal !== null && typeof r.terminal === "object") {
         const t = r.terminal;
-        if (t.kind === "failed" && typeof t.message === "string") {
-            out.terminal = { ...t, message: redactErrorMessage(t.message) };
-            changed = true;
+        let nt;
+        if (t.kind === "failed" && typeof t.message === "string")
+            nt = { ...t, message: redactErrorMessage(t.message) };
+        else if (t.kind === "blocked" && typeof t.reason === "string")
+            nt = { ...t, reason: redactErrorMessage(t.reason) };
+        const gateOf = (cause) => {
+            if (cause === null || typeof cause !== "object" || !("gate" in cause))
+                return undefined;
+            const g = cause.gate;
+            const ng = redactCheckpointGate(g);
+            return { gate: ng, changed: ng !== g };
+        };
+        const base = nt ?? t;
+        if (t.kind === "paused") {
+            const g = gateOf(base);
+            if (g?.changed === true)
+                nt = { ...base, gate: g.gate };
+        }
+        else if (t.kind === "failed") {
+            const np = base.nestedPause;
+            const g = gateOf(np);
+            if (g?.changed === true)
+                nt = { ...base, nestedPause: { ...np, gate: g.gate } };
         }
-        else if (t.kind === "blocked" && typeof t.reason === "string") {
-            out.terminal = { ...t, reason: redactErrorMessage(t.reason) };
+        if (nt !== undefined) {
+            out.terminal = nt;
             changed = true;
         }
     }
@@ -136,6 +195,11 @@ export function redactLedgerEventData(type, data) {
             return data;
         return { ...data, errorMessage: redactErrorMessage(msg) };
     }
+    if (isParkLedgerEventType(type)) {
+        const gate = data.gate;
+        const next = redactCheckpointGate(gate);
+        return next === gate ? data : { ...data, gate: next };
+    }
     return data;
 }
 export function redactWorkerReportError(report) {
@@ -145,38 +209,123 @@ export function redactWorkerReportError(report) {
         return report;
     return { ...report, ...(error !== report.error ? { error } : {}), ...(gate !== report.checkpointGate ? { checkpointGate: gate } : {}) };
 }
+const RISK_DESCRIPTOR_TREATMENT = {
+    severity: "verbatim",
+    axes: "verbatim",
+    toolName: "verbatim",
+    shellGateDoctrine: "verbatim",
+    summary: "text",
+    touchedPaths: "text[]",
+    shadowedRule: "text",
+    probeReason: "text",
+    probeCause: "probe-cause",
+};
+const PROBE_CAUSE_TREATMENT = {
+    code: "verbatim",
+    roots: "operands",
+    further: "operands",
+};
+const PROBE_CAUSE_OPERANDS_TREATMENT = {
+    shown: "text[]",
+    total: "verbatim",
+};
+export function redactRiskDescriptor(rd) {
+    if (rd === null || typeof rd !== "object" || Array.isArray(rd))
+        return rd;
+    const r = rd;
+    let changed = false;
+    const str = (v) => { const o = redactErrorMessage(v) ?? ""; if (o !== v)
+        changed = true; return o; };
+    const strs = (v) => (Array.isArray(v) ? v.map((x) => (typeof x === "string" ? str(x) : x)) : v);
+    const out = { ...r };
+    for (const [key, treatment] of Object.entries(RISK_DESCRIPTOR_TREATMENT)) {
+        switch (treatment) {
+            case "verbatim":
+                break;
+            case "text":
+                if (typeof r[key] === "string")
+                    out[key] = str(r[key]);
+                break;
+            case "text[]":
+                if (Array.isArray(r[key]))
+                    out[key] = strs(r[key]);
+                break;
+            case "probe-cause": {
+                const pc = r[key];
+                if (pc === null || typeof pc !== "object" || Array.isArray(pc))
+                    break;
+                const p = pc;
+                const np = { ...p };
+                for (const [ck, ct] of Object.entries(PROBE_CAUSE_TREATMENT)) {
+                    if (ct === "verbatim")
+                        continue;
+                    const ops = p[ck];
+                    if (ops === null || typeof ops !== "object" || Array.isArray(ops))
+                        continue;
+                    const o = ops;
+                    const no = { ...o };
+                    for (const [ok, ot] of Object.entries(PROBE_CAUSE_OPERANDS_TREATMENT)) {
+                        if (ot === "text[]" && Array.isArray(o[ok]))
+                            no[ok] = strs(o[ok]);
+                    }
+                    np[ck] = no;
+                }
+                out[key] = np;
+                break;
+            }
+            default: {
+                const unhandled = treatment;
+                throw new Error(`unhandled leaf treatment: ${String(unhandled)}`);
+            }
+        }
+    }
+    return changed ? out : rd;
+}
+const CHECKPOINT_GATE_TREATMENT = {
+    kind: "verbatim",
+    reason: "text",
+    toolName: "verbatim",
+    riskDescriptor: "risk-descriptor",
+    safetyAxis: "verbatim",
+    realApproval: "verbatim",
+    resumeAfterMs: "verbatim",
+};
 export function redactCheckpointGate(gate) {
     if (gate === null || typeof gate !== "object" || Array.isArray(gate))
         return gate;
     const g = gate;
-    let changed = false;
     const out = { ...g };
-    const str = (v) => { const o = redactErrorMessage(v) ?? ""; if (o !== v)
-        changed = true; return o; };
-    const strs = (v) => (Array.isArray(v) ? v.map((x) => (typeof x === "string" ? str(x) : x)) : v);
-    if (typeof g.reason === "string")
-        out.reason = str(g.reason);
-    const rd = g.riskDescriptor;
-    if (rd && typeof rd === "object" && !Array.isArray(rd)) {
-        const r = rd;
-        const nr = { ...r };
-        for (const k of ["summary", "shadowedRule", "probeReason"])
-            if (typeof r[k] === "string")
-                nr[k] = str(r[k]);
-        if (Array.isArray(r.touchedPaths))
-            nr.touchedPaths = strs(r.touchedPaths);
-        const pc = r.probeCause;
-        if (pc && typeof pc === "object" && !Array.isArray(pc)) {
-            const p = pc;
-            const np = { ...p };
-            for (const k of ["roots", "further"]) {
-                const ops = p[k];
-                if (ops && typeof ops === "object" && !Array.isArray(ops) && Array.isArray(ops.shown))
-                    np[k] = { ...ops, shown: strs(ops.shown) };
+    let changed = false;
+    for (const [key, treatment] of Object.entries(CHECKPOINT_GATE_TREATMENT)) {
+        switch (treatment) {
+            case "verbatim":
+                break;
+            case "text": {
+                const v = g[key];
+                if (typeof v !== "string")
+                    break;
+                const next = redactErrorMessage(v) ?? "";
+                if (next !== v) {
+                    out[key] = next;
+                    changed = true;
+                }
+                break;
+            }
+            case "risk-descriptor": {
+                if (!(key in g))
+                    break;
+                const next = redactRiskDescriptor(g[key]);
+                if (next !== g[key]) {
+                    out[key] = next;
+                    changed = true;
+                }
+                break;
+            }
+            default: {
+                const unhandled = treatment;
+                throw new Error(`unhandled gate field treatment: ${String(unhandled)}`);
             }
-            nr.probeCause = np;
         }
-        out.riskDescriptor = nr;
     }
     return changed ? out : gate;
 }
@@ -366,9 +515,11 @@ export function memoRedactTerminalResult(seat, result) {
     if (result === undefined || result === null)
         return result;
     const r = result;
-    if (r.terminal === undefined && r.errorMessage === undefined && r.blockedReason === undefined && r.remoteEnvFailures === undefined)
+    if (REDACTABLE_RESULT_LEAVES.every((k) => r[k] === undefined))
         return result;
-    const leaves = { terminal: r.terminal, errorMessage: r.errorMessage, blockedReason: r.blockedReason, remoteEnvFailures: r.remoteEnvFailures };
+    const leaves = {};
+    for (const k of REDACTABLE_RESULT_LEAVES)
+        leaves[k] = r[k];
     const redacted = memoRedactedRead(seat, leaves, (l) => redactTerminalResult(l));
     if (redacted === leaves)
         return result;

package/dist/observability/tool-trace.d.ts

@@ -14,6 +14,18 @@ import type { Metrics } from "./metrics.js";
  * 🔴 BREAKING(server 7.64.0,core 7.6.0 提货):标签名 `source` → `deniedBy`,词表从七词
  * (`policy/hook/safety/shellGate/planMode/classifier/org`)换成八词
  * (`policy/hook/org/classifier/plan_mode/compliance/write_protection/ask_resolution`)。仪表盘/告警规则要改。
+ *
+ * 🔴 **第二个计数器 `auto_mode_classifier_unavailable_total{cause}`(server 7.70.0,core 7.12.0 [ref])**
+ * —— 分类器**停摆**的常开信号。7.12.0 之前这件事有两条可观测路:熔断跳闸时的
+ * `auto_mode_breaker_open_total`,以及「`unavailable` 的 ask 会走到人面前」(审批 inbox 里看得见)。
+ * 该版把熔断族整族退役、又把 `unavailable` 改成**当场 deny** ⇒ 两条路同时没了,而
+ * `permission_denied_total{deniedBy}` 对它是**瞎的**:分类器停摆与分类器正常拦下一次危险调用,
+ * 两者都记 `deniedBy:"classifier"`。一次持续停摆于是在默认监控上与「今天安全拦截多了点」不可区分
+ * (`TOOL_TRACE` 默认关,拿不到那半边)。core 同批把事实加在了 deny 上
+ * (`PermissionDeniedPayload.classifierUnavailable`),本仓就在**这同一只常开观察者**上消费它。
+ * 两个计数刻意**不合并成一个标签**:它们答两个问题(「谁拒的」vs「这次拒是不是因为分类器停摆、哪一类」),
+ * 而运维对停摆要立刻动手(改配置 / 等重试 / 看后端),对安全拦截不要。
+ * ⛔ 纯计量:不改任何裁决、不新开观察面、事实缺席时**不铸**(缺席 ≠ 「分类器好着呢」,只是这次拒不是它)。
  */
 export declare function createPermissionDeniedMeter(metrics: Pick<Metrics, "inc">): Hooks;
 /**

package/dist/observability/tool-trace.js

@@ -1,4 +1,4 @@
-import { isDeniedBy } from "@sema-agent/core";
+import { isAutoModeUnavailableCause, isDeniedBy } from "@sema-agent/core";
 import { redactSecrets } from "../trace/redact.js";
 function deniedByLabel(gate) {
     const d = gate.disposition;
@@ -8,6 +8,10 @@ export function createPermissionDeniedMeter(metrics) {
     return {
         permissionDenied(payload) {
             metrics.inc("permission_denied_total", { deniedBy: deniedByLabel(payload.gate) });
+            const cause = payload.classifierUnavailable?.cause;
+            if (cause !== undefined) {
+                metrics.inc("auto_mode_classifier_unavailable_total", { cause: isAutoModeUnavailableCause(cause) ? cause : "other" });
+            }
         },
     };
 }

package/dist/operator-ask.d.ts

@@ -0,0 +1,46 @@
+/**
+ * **运维写下的 ask 一律自报为「显式 ask 规则」** —— 本仓所有 operator/治理面 `ask` 裁决的**唯一**铸造点。
+ *
+ * ── 为什么存在(成因是一次真红,不是预防性设计)────────────────────────────────────────────────
+ * core 7.11.0 [ref] 给 allow 层加了**第二位成员**:一条被 `readOnlyShellVerdict` 证明只读的 shell 命令,
+ * 在每一道收紧车道之后**直接放行**(`decisionReason:"read_only"`),没有分类器轮次、没有卡、没有 park。
+ * 它的消费谓词(`allowLayerMayClear`,与持久 allow 规则**同一只**)明写不会越过的几件事里,有一件是
+ * **显式 ask 规则**(`PermissionResult.matchedAskRule`)。
+ *
+ * 而本仓的 operator 门此前铸的是**裸** `{action:"ask", message}` —— 一条「someone WROTE 了这条规则」的
+ * 事实,从来没有在裁决上说出口。于是 7.11.0 提货那一拍,`APPROVAL_REQUIRE=Bash` 的部署上
+ * `echo x` / `cd sub` / `grep -r … ` 这一类**全部静默自动执行**:运维亲手写下的「这只工具必须人批」被
+ * 一个自动层清掉了,而且**一声不响**(本仓 7.68.0 的四条 e2e 当场红,那是这条缺口的机器证据)。
+ *
+ * ── 修法:一条规则,一个铸点 ────────────────────────────────────────────────────────────────
+ * core 的 `matchedAskRule` 顶注逐字给了自声明的授权与方向:「A policy self-declaring the member only ever
+ * OPTS ITS OWN ask OUT of classifier auto-resolution (**tightening** — the false-claim direction is safe)」。
+ * 所以本仓把它做成**不变量**而不是补丁:凡是「运维/部署写下的声明产生的 ask」,一律经本函数铸,自带那条
+ * 声明的原文。于是**任何**自动放行层(今天的持久规则与只读判词,明天的第三位成员)都够不着它 —— 规则从
+ * 「每来一个新 allow 层就回来补一次名单」变成「运维写的 ask 不可被自动清除」这一句。
+ *
+ * 🔴 **副作用是有意的、且方向只有一个**:带 `matchedAskRule` 的 ask 同时**退出 auto 模式分类器的自动
+ * 裁决**(core:「a person's standing "ask me each time" is not classifier hesitation」)。对
+ * `APPROVAL_NEVER_AUTO` 这是把一条**本来就漏**的缝补上(那张表的语义逐字是「always human」,而分类器
+ * 今天能替它答);对 `APPROVAL_REQUIRE` / `commandPolicy` 这是收紧一格 —— 与这两个旋钮的字面语义
+ * (「必须批准」)一致,且方向是 fail-closed。
+ *
+ * 🔴 **谁不进这扇门**(逐条,判据在 core 的同一段顶注):
+ *  · **模式默认**的 ask(`task-settings.ts` 的 plan/default 档折叠)—— core 明写 `matchedAskRule`
+ *    「never for a `defaultAction:"ask"` fallback(an unmatched call is default-closed posture, not a
+ *    per-call instruction)」;把姿态默认伪装成一条写下的规则会让分类器车道的资格判据整条失真。
+ *  · **钩子**的 ask(`hooks/hook-runner.ts`)—— core 在钩子面**自己盖** `decisionReason:"hook"`
+ *    (`dist/core/gate-fold.js`),那是 `allowLayerMayClear` 的另一条独立豁免;本仓再盖一次是第二个写者。
+ *  · **问答工具**(`deployment-governance.ts` 的 `AskUserQuestion`)—— core 的谓词把保留问答工具单列豁免。
+ */
+import type { PermissionResult } from "@sema-agent/core";
+/**
+ * 铸一条**运维声明产生的** `ask`。
+ *
+ * @param rule 产生这条 ask 的**声明原文**(进 `matchedAskRule`)。它是 gate 内部消费的机器位 ——
+ *   core 顶注逐字:「consumed inside the gate and deliberately NOT copied onto the park/approval-card
+ *   request」,所以它既不上 wire、也不进卡,写的必须是**真实的那条声明**而不是一句好看的话。
+ * @param message 给人看的那句话(照旧上卡)。
+ */
+export declare function operatorAsk(rule: string, message: string): PermissionResult;
+//# sourceMappingURL=operator-ask.d.ts.map

package/dist/operator-ask.js

@@ -0,0 +1,4 @@
+export function operatorAsk(rule, message) {
+    return { action: "ask", message, decisionReason: "rule", matchedAskRule: rule };
+}
+//# sourceMappingURL=operator-ask.js.map

package/dist/orchestration/workflow-agent-session-index.d.ts

@@ -0,0 +1,96 @@
+/** 一条索引行:**子会话 id 是主键**(会话 id 全局唯一 ⇒ 读口天然是单行精确查,无分页假阴性)。 */
+export interface WorkflowAgentSessionRow {
+    /** parked 的那只 workflow 子代自己的会话 id(= `WorkflowAgentRun.sessionId` = checkpoint 的 `sourceTaskId`)。 */
+    sessionId: string;
+    /** 它所属的 workflow run(`w*`)。 */
+    runId: string;
+    /** 该 agent 调用的稳定顺位身份(`WorkflowAgentRun.callKey`)—— 行自描述用,取 run 后仍以行内实体为准。 */
+    agentKey: string;
+    /** run 的租户键(`WorkflowRun.scope`)。 */
+    scope: string;
+}
+/**
+ * 索引面的两个动词。**写者只有一个**(见文件头),读者是判别器/收敛器/读面。
+ *
+ * `syncRun` 语义 = 「这条 run 当前的 parked 行集**就是** rows」:多出来的旧行删,rows 里的行 upsert。
+ * 幂等、可重放、与 run 的一次成功写同拍。
+ */
+export interface WorkflowAgentSessionIndex {
+    syncRun(runId: string, rows: readonly WorkflowAgentSessionRow[]): Promise<void>;
+    findByAgentSession(sessionId: string): Promise<WorkflowAgentSessionRow | null>;
+}
+/** 派生的**唯一属主**:一只 `WorkflowRun` 当前的 parked 索引行。
+ *
+ *  三个键缺任何一个都不入索引 —— 缺 `sessionId` 的 park 行 join 不到(checkpoint 那侧的键就是它),
+ *  缺 `parkedCheckpointToken` 的行不是一条可赎回的 park(core 契约:在场 ⟺ `status:"parked"`)。
+ *  ⚠️ token **不进索引行**:它是赎回能力,家在 run 的 blob 里(与 bg 行同判),索引只回答「去哪条 run 找」。 */
+export declare function buildParkedAgentSessionRows(runId: string, run: {
+    scope: string;
+    agents?: ReadonlyArray<{
+        status?: string;
+        sessionId?: string;
+        callKey?: string;
+        parkedCheckpointToken?: string;
+    }>;
+}): WorkflowAgentSessionRow[];
+/** 两处(装饰器的变更检测、local 后端的重放)共用的行集等值判据 —— 顺序无关的集合比较,单一属主。 */
+export declare function sameAgentSessionRows(a: readonly WorkflowAgentSessionRow[], b: readonly WorkflowAgentSessionRow[]): boolean;
+/** 账本一行的**内域形**:一次 `syncRun` 的整份行集快照(`{runId, rows}`)。 */
+export interface WorkflowAgentSessionLedgerLine {
+    runId: string;
+    rows: WorkflowAgentSessionRow[];
+}
+/**
+ * 盘上账本行 → 内域形的**唯一读者**(宪法 [ref] §2:进程外字节禁裸 `as` 铸形)。
+ *
+ * 姿态与 SQL 孪生逐字同源:那边 `findByAgentSession` 逐字段收窄(`String(r.session_id)` …),这边逐字段
+ * 判形 —— 一张索引面、两个后端、**一种**入域姿态。
+ *
+ * **整行成败制**(与既有的撕裂行臂同一条规则):一行 = 一次 syncRun 的**整份**快照,任一位读不出来就说明
+ * 这份快照重建不出来 ⇒ 整行不 apply(那条 run 保留上一份已知良好的快照)。不做「丢掉坏成员、留下好成员」
+ * ——那会静默铸出一份**比真相少几条 park** 的行集,而这条索引的消费面正是 park 的赎回路由。
+ * 读不出来 ⇒ 调用方**响亮**记一笔([ref]:安全轴不许静默),不吞整档。
+ */
+export declare function readAgentSessionLedgerLine(v: unknown): WorkflowAgentSessionLedgerLine | undefined;
+/**
+ * 单机车道的索引(`FileWorkflowRunStore` / `InMemoryWorkflowRunStore` 的同室孪生)。
+ *
+ * `root` 在场 ⇒ 追加式 JSONL 账本(与姊妹 {@link import("./workflow-notify-journal.js").FileWorkflowNotifyJournalStore}
+ * 逐字同形:0o700 目录 + 0o600 账本、按行重放、末行撕裂即丢),重启后 park 仍可 join;缺席 ⇒ 纯内存
+ * (`WORKFLOW_RUN_STORE=memory` 的显式易失车道,与它的 run 店同寿命)。
+ *
+ * 账本的一行 = **一次 `syncRun` 的整份行集**(按 runId 后写覆盖),所以重放即收敛,不需要压缩腿。
+ */
+export declare class LocalWorkflowAgentSessionIndex implements WorkflowAgentSessionIndex {
+    private readonly fsyncEnabled;
+    /** 坏账本行的**响亮**出口(可选;缺席 ⇒ 那一行照样不入索引,只是没人听见)。形与 workflow 店族的
+     *  `onWarn` 逐字同源(`workflow-completion-inbox.ts` 的那一只),不另立第二种披露通道。 */
+    private readonly onWarn?;
+    private readonly ledgerPath;
+    private readonly byRun;
+    private readonly bySession;
+    private fd;
+    constructor(root?: string, fsyncEnabled?: boolean, 
+    /** 坏账本行的**响亮**出口(可选;缺席 ⇒ 那一行照样不入索引,只是没人听见)。形与 workflow 店族的
+     *  `onWarn` 逐字同源(`workflow-completion-inbox.ts` 的那一只),不另立第二种披露通道。 */
+    onWarn?: ((msg: string, meta: Record<string, unknown>) => void) | undefined);
+    /**
+     * 打开账本时把**撕裂尾**(崩在 append 中途、末尾没有换行的那截字节)截回最后一个完整行边界。
+     *
+     * 🔴 为什么必须在**任何 append 之前**做(codex 修复验证轮 [medium],故障注入复现):残尾留在盘上时,
+     * 下一次 `syncRun` 会紧贴着它落字节 ⇒ `<残尾><新记录>` 在 replay 里是**一行**,JSON 解析失败被整行丢掉。
+     * 丢的**不是**那截未提交的残尾(丢它是对的),而是紧随其后那次**成功重试**写下的行 —— 于是「写失败了
+     * 下一次写会重试救回来」这条本模块与 `syncAgentSessionIndex` 都在依赖的性质当场失效,park 索引静默消失。
+     * 截尾之后 append 永远从一个干净的行边界开始,重试才真的救得回来。
+     *
+     * 截掉的只可能是**未提交**的字节(一条记录的耐久性以它那个换行为界,与 notify journal 同一条崩溃序),
+     * 所以这里不是丢数据;但它是一次真实的崩溃留痕,**响亮**一次([ref]:安全轴不许静默)。
+     */
+    private truncateTornTail;
+    private replay;
+    /** 内存两张表的收敛(重放与写路径共用一份逻辑)。 */
+    private apply;
+    syncRun(runId: string, rows: readonly WorkflowAgentSessionRow[]): Promise<void>;
+    findByAgentSession(sessionId: string): Promise<WorkflowAgentSessionRow | null>;
+}
+//# sourceMappingURL=workflow-agent-session-index.d.ts.map