create-windy 0.6.11 → 0.6.14

package/template/apps/server/src/agent/session-run-recovery.ts

@@ -0,0 +1,16 @@
+import type { SessionId } from "./session-log/domain.js";
+import { SessionRepositoryConflict } from "./session-log/repository.js";
+
+export class SessionTurnRecoveryError extends Error {
+  readonly code = "SESSION_TURN_RECOVERY_REQUIRED" as const;
+  readonly recoverable = true as const;
+
+  constructor(readonly sessionId: SessionId) {
+    super("Session Turn 并发补偿未收敛，可用相同幂等请求恢复");
+    this.name = "SessionTurnRecoveryError";
+  }
+}
+
+export function isSequenceConflict(error: unknown) {
+  return error instanceof SessionRepositoryConflict && error.code === "SEQUENCE_CONFLICT";
+}

package/template/apps/server/src/agent/session-runtime-composition.ts

@@ -0,0 +1,265 @@
+import type { ModuleManifest } from "@southwind-ai/modules";
+import { agentSourceInvalidations } from "@southwind-ai/database";
+import { and, desc, eq } from "drizzle-orm";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { RequestActor } from "../guards.js";
+import type { createServerRuntime } from "../runtime.js";
+import type { RouteApp } from "../system/routes.js";
+import { GovernedMemoryRetriever } from "./context-memory/memory-retriever.js";
+import { GovernedMemoryProjector } from "./context-memory/memory-projector.js";
+import {
+  ModuleAuthoritativeSourceAccessRegistry,
+  type ModuleAuthoritativeSourceAdapterRegistration,
+} from "./context-memory/authoritative-source-registry.js";
+import {
+  ModuleMemoryObjectAuthorizationRegistry,
+  type ModuleMemoryObjectAdapterRegistration,
+} from "./context-memory/memory-object-registry.js";
+import { AgentContextVersionRuntime } from "./context-version-runtime.js";
+import {
+  registerAgentContextVersionRoutes,
+  registerUnavailableAgentContextVersionRoute,
+} from "./context-version-routes.js";
+import {
+  DrizzleGovernedMemorySearch,
+  GovernedMemoryObjectAuthorization,
+  RuntimeMemoryCapabilityAuthorizer,
+  RuntimeMemoryProjectionWriteAuthorizer,
+} from "./memory-runtime-adapters.js";
+import type { AgentRunAuthorizationStore } from "./run-authorization.js";
+import { AgentRunSessionBindingAuthorizer } from "./run-session-authorization.js";
+import { DrizzleSessionAuthoritativeSourceAccess } from "./session-context-source.js";
+import {
+  authorizationCoordinateForActor,
+  ResolvingCurrentSourceAuthorizationPort,
+  SessionProjectionSourceAuthorizer,
+} from "./session-projection-access.js";
+import { registerAgentSessionProjectionRuntime } from "./session-projection-bootstrap.js";
+import {
+  CanonicalMemoryIndexInvalidationPort,
+  SourceInvalidationScheduler,
+} from "./session-invalidation/runtime.js";
+import {
+  DrizzleContextProjectionReader,
+  DrizzleMemoryProjectionStore,
+} from "./session-persistence/drizzle-context-memory.js";
+import { DrizzleSessionInvalidationOutbox } from "./session-persistence/drizzle-invalidation-outbox.js";
+import {
+  DatabaseBackedUiInvalidationProjection,
+  DelegatingInvalidationProjection,
+  DrizzleContextInvalidationProjection,
+  DrizzleMemoryInvalidationProjection,
+} from "./session-persistence/invalidation-projections.js";
+import { DrizzleSessionEventRepository } from "./session-persistence/drizzle-session-repository.js";
+import { AgentSessionPayloadCodec } from "./session-persistence/payload-codec.js";
+import type { AgentRuntimePort } from "./run-contracts.js";
+import { SessionRunResultMemoryProjector } from "./session-result-memory.js";
+import { SessionTerminalReconciler } from "./session-terminal-reconciler.js";
+import type { AgentAuthorizationInvalidationInput } from "../system/authorization-invalidation-bridge.js";
+import { WorkingContextExpiryScheduler } from "./context-memory/working-context-expiry.js";
+
+export function composeAgentLongSessionRuntime(input: {
+  readonly app: RouteApp;
+  readonly db?: NodePgDatabase;
+  readonly secret: string;
+  readonly internalToken: string;
+  readonly modules: readonly ModuleManifest[];
+  readonly runtime: ReturnType<typeof createServerRuntime>;
+  readonly remote: AgentRuntimePort;
+  readonly authorizations: AgentRunAuthorizationStore;
+  readonly resolveActor: (actorId: string) => Promise<RequestActor | undefined>;
+  readonly authoritativeSources?: readonly ModuleAuthoritativeSourceAdapterRegistration[];
+  readonly memoryObjects?: readonly ModuleMemoryObjectAdapterRegistration[];
+}) {
+  if (!input.db) {
+    registerAgentSessionProjectionRuntime(input.app, undefined, input.secret);
+    registerUnavailableAgentContextVersionRoute(input.app, input.internalToken);
+    return undefined;
+  }
+  const codec = new AgentSessionPayloadCodec(input.secret);
+  const repository = new DrizzleSessionEventRepository(input.db, codec);
+  const sourceAccess = new DrizzleSessionAuthoritativeSourceAccess(
+    input.db,
+    codec,
+    repository,
+    input.remote,
+  );
+  const currentAuthorization = new ResolvingCurrentSourceAuthorizationPort(
+    input.resolveActor,
+  );
+  const authoritativeSources = new ModuleAuthoritativeSourceAccessRegistry([
+    { moduleKey: "system.agent", access: sourceAccess },
+    ...(input.authoritativeSources ?? []),
+  ]);
+  sourceAccess.bindMemorySourceAuthority(authoritativeSources);
+  const sourceAuthorizer = new SessionProjectionSourceAuthorizer(
+    authoritativeSources,
+    currentAuthorization,
+  );
+  const memoryObjects = new ModuleMemoryObjectAuthorizationRegistry(
+    input.memoryObjects ?? [],
+  );
+  const memoryObjectAuthorization = new GovernedMemoryObjectAuthorization(
+    repository,
+    sourceAuthorizer,
+    memoryObjects,
+  );
+  const projection = registerAgentSessionProjectionRuntime(
+    input.app,
+    input.db,
+    input.secret,
+    {
+      sourceAccess: authoritativeSources,
+      currentSourceAuthorization: currentAuthorization,
+      memoryObjectAuthorization,
+    },
+  );
+  if (!projection) throw new Error("长期 Session 投影装配失败");
+
+  const sessionAuthorization = new AgentRunSessionBindingAuthorizer(
+    input.modules,
+    input.runtime,
+  );
+  const memories = new DrizzleMemoryProjectionStore(input.db, codec);
+  const memoryRetriever = new GovernedMemoryRetriever(
+    new RuntimeMemoryCapabilityAuthorizer(input.runtime),
+    new DrizzleGovernedMemorySearch(input.db),
+    memories,
+    memoryObjectAuthorization,
+  );
+  const memoryFeature = input.modules
+    .flatMap(({ features }) => features)
+    .find(({ key }) => key === "system.agent-session");
+  if (!memoryFeature) throw new Error("长期 Session Memory Feature 未注册");
+  const memoryProjector = new GovernedMemoryProjector(
+    memories,
+    new RuntimeMemoryProjectionWriteAuthorizer(
+      input.runtime,
+      memoryFeature,
+      `${memoryFeature.key}.manage`,
+    ),
+    memoryObjectAuthorization,
+  );
+  const resultMemory = new SessionRunResultMemoryProjector(
+    repository,
+    memoryProjector,
+    projection.projectionReceipts,
+    input.authorizations,
+  );
+  registerAgentContextVersionRoutes(
+    input.app,
+    new AgentContextVersionRuntime(
+      input.db,
+      input.secret,
+      repository,
+      input.runtime,
+      input.authorizations,
+      sessionAuthorization,
+      input.resolveActor,
+      sourceAuthorizer,
+      memoryRetriever,
+      memoryFeature,
+      memoryProjector,
+      new SessionTerminalReconciler(
+        repository,
+        input.remote,
+        projection.runLink,
+        resultMemory,
+      ),
+    ),
+    input.internalToken,
+  );
+
+  const contextInvalidation = new DrizzleContextInvalidationProjection(
+    input.db,
+  );
+  const memoryInvalidation = new DrizzleMemoryInvalidationProjection(input.db);
+  const invalidationOutbox = new DrizzleSessionInvalidationOutbox(input.db);
+  const indexInvalidation = new CanonicalMemoryIndexInvalidationPort(
+    memoryInvalidation,
+  );
+  const scheduler = new SourceInvalidationScheduler(invalidationOutbox, {
+    context: contextInvalidation,
+    memory: memoryInvalidation,
+    search: new DelegatingInvalidationProjection("search", indexInvalidation),
+    embedding: new DelegatingInvalidationProjection(
+      "embedding",
+      indexInvalidation,
+    ),
+    ui: new DatabaseBackedUiInvalidationProjection(),
+  });
+  const workingContextExpiry = new WorkingContextExpiryScheduler(
+    input.db,
+    codec,
+    authoritativeSources,
+    invalidationOutbox,
+  );
+
+  return {
+    ...projection,
+    contextReader: new DrizzleContextProjectionReader(input.db),
+    memoryRetriever,
+    memoryProjector,
+    resultMemory,
+    authoritativeSources,
+    invalidationOutbox,
+    invalidateAuthorization: (event: AgentAuthorizationInvalidationInput) =>
+      invalidateActorAuthorization(
+        event,
+        authoritativeSources,
+        invalidationOutbox,
+      ),
+    dispose() {
+      workingContextExpiry.dispose();
+      scheduler.dispose();
+    },
+  };
+}
+
+async function invalidateActorAuthorization(
+  input: AgentAuthorizationInvalidationInput,
+  sources: ModuleAuthoritativeSourceAccessRegistry,
+  outbox: DrizzleSessionInvalidationOutbox,
+) {
+  const authorization = authorizationCoordinateForActor(input.previousActor);
+  const sourceKind = "authorization-scope";
+  const [latest] = await input.database
+    .select({ sequence: agentSourceInvalidations.sequence })
+    .from(agentSourceInvalidations)
+    .where(
+      and(
+        eq(agentSourceInvalidations.sourceModuleKey, "system.agent"),
+        eq(agentSourceInvalidations.sourceKind, sourceKind),
+        eq(agentSourceInvalidations.sourceId, authorization.actorId),
+      ),
+    )
+    .orderBy(desc(agentSourceInvalidations.sequence))
+    .limit(1);
+  const occurredAt = Date.parse(input.occurredAt);
+  if (!Number.isSafeInteger(occurredAt) || occurredAt < 1) {
+    throw new Error("Agent 授权失效时间坐标无效");
+  }
+  const sequence = Math.max(occurredAt, (latest?.sequence ?? 0) + 1);
+  const producer = sources.bindInvalidationProducer({
+    moduleKey: "system.agent",
+    authorization,
+    append: {
+      append: (envelope) =>
+        outbox.appendInTransaction(input.database, envelope),
+    },
+  });
+  const result = await producer.authorizationRevoked({
+    source: {
+      sourceKind,
+      sourceId: authorization.actorId,
+      version: authorization.scopeDigest,
+      sequence,
+    },
+    event: {
+      eventId: input.eventId,
+      eventSequence: sequence,
+      occurredAt: input.occurredAt,
+    },
+  });
+  if (result === "stale") throw new Error("Agent 授权失效序列未收敛");
+}

package/template/apps/server/src/agent/session-source-chain-authorizer.ts

@@ -0,0 +1,141 @@
+import {
+  agentContextSources,
+  agentMemorySources,
+} from "@southwind-ai/database";
+import { asc, eq } from "drizzle-orm";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type {
+  AuthoritativeSourceAccessPort,
+  AuthoritativeSourceAccessQuery,
+} from "./session-invalidation/contracts.js";
+import { requireAuthoritativeSourceRead } from "./session-invalidation/read-guard.js";
+
+const SOURCE_CHAIN_AUDIT = Symbol("agent-source-chain-audit");
+const MAX_CHAIN_DEPTH = 32;
+const MAX_CHAIN_COORDINATES = 2_048;
+
+interface SourceChainAudit {
+  readonly active: Set<string>;
+  readonly complete: Set<string>;
+  coordinates: number;
+}
+
+type AuditedQuery = AuthoritativeSourceAccessQuery & {
+  readonly [SOURCE_CHAIN_AUDIT]?: SourceChainAudit;
+};
+
+export function createSourceChainAudit(): SourceChainAudit {
+  return { active: new Set(), complete: new Set(), coordinates: 0 };
+}
+
+export function withSourceChainAudit(
+  query: AuthoritativeSourceAccessQuery,
+  audit: SourceChainAudit,
+): AuthoritativeSourceAccessQuery {
+  return Object.assign(query, { [SOURCE_CHAIN_AUDIT]: audit });
+}
+
+export async function requireContextSourceChain(
+  db: NodePgDatabase,
+  contextVersionId: string,
+  authority: AuthoritativeSourceAccessPort,
+  query: AuthoritativeSourceAccessQuery,
+) {
+  await requireAudited(`context:${contextVersionId}`, query, async (audit) => {
+    const sources = await db
+      .select()
+      .from(agentContextSources)
+      .where(eq(agentContextSources.contextVersionId, contextVersionId))
+      .orderBy(asc(agentContextSources.ordinal));
+    await requireChain(
+      sources.filter(
+        ({ sourceModuleKey, sourceId }) =>
+          !(
+            sourceModuleKey === "system.agent" &&
+            sourceId.startsWith(`${contextVersionId}:`)
+          ),
+      ),
+      authority,
+      query,
+      audit,
+    );
+  });
+}
+
+export async function requireMemorySourceChain(
+  db: NodePgDatabase,
+  memoryId: string,
+  authority: AuthoritativeSourceAccessPort,
+  query: AuthoritativeSourceAccessQuery,
+) {
+  await requireAudited(`memory:${memoryId}`, query, async (audit) => {
+    const sources = await db
+      .select()
+      .from(agentMemorySources)
+      .where(eq(agentMemorySources.memoryId, memoryId))
+      .orderBy(asc(agentMemorySources.ordinal));
+    if (!sources.length) throw new Error("Memory 来源链无效");
+    await requireChain(sources, authority, query, audit);
+  });
+}
+
+async function requireChain(
+  sources: readonly SourceRow[],
+  authority: AuthoritativeSourceAccessPort,
+  query: AuthoritativeSourceAccessQuery,
+  audit: SourceChainAudit,
+) {
+  for (const item of sources) {
+    audit.coordinates += 1;
+    if (audit.coordinates > MAX_CHAIN_COORDINATES) {
+      throw new Error("来源链复核超出上限");
+    }
+    await requireAuthoritativeSourceRead(
+      authority,
+      withSourceChainAudit(
+        {
+          source: {
+            moduleKey: item.sourceModuleKey,
+            sourceKind: item.sourceKind,
+            sourceId: item.sourceId,
+            version: item.sourceVersion,
+            sequence: item.sourceSequence,
+            digest: item.sourceDigest,
+          },
+          authorization: query.authorization,
+          requestId: query.requestId,
+        },
+        audit,
+      ),
+    );
+  }
+}
+
+async function requireAudited(
+  key: string,
+  query: AuthoritativeSourceAccessQuery,
+  verify: (audit: SourceChainAudit) => Promise<void>,
+) {
+  const audit =
+    (query as AuditedQuery)[SOURCE_CHAIN_AUDIT] ?? createSourceChainAudit();
+  if (audit.complete.has(key)) return;
+  if (audit.active.has(key) || audit.active.size >= MAX_CHAIN_DEPTH) {
+    throw new Error("来源链存在环或超出深度上限");
+  }
+  audit.active.add(key);
+  try {
+    await verify(audit);
+    audit.complete.add(key);
+  } finally {
+    audit.active.delete(key);
+  }
+}
+
+interface SourceRow {
+  readonly sourceModuleKey: string;
+  readonly sourceKind: string;
+  readonly sourceId: string;
+  readonly sourceVersion: string;
+  readonly sourceSequence: number;
+  readonly sourceDigest: string;
+}

package/template/apps/server/src/agent/session-terminal-reconciler.ts

@@ -0,0 +1,100 @@
+import type { ModuleAiJsonValue } from "@southwind-ai/server-sdk";
+import type { RequestGuardContext } from "../guards.js";
+import type { AgentRuntimePort } from "./run-contracts.js";
+import type { AgentRunSessionLinkPort } from "./session-run-link.js";
+import type { SessionId } from "./session-log/domain.js";
+import type { SessionEventEnvelope } from "./session-log/events.js";
+import type { DrizzleSessionEventRepository } from "./session-persistence/drizzle-session-repository.js";
+import type { SessionRunResultMemoryPort } from "./session-result-memory.js";
+
+/** Repairs terminal Run facts and result Memory before the next attempt is built. */
+export class SessionTerminalReconciler {
+  constructor(
+    private readonly repository: DrizzleSessionEventRepository,
+    private readonly remote: AgentRuntimePort,
+    private readonly links: AgentRunSessionLinkPort,
+    private readonly results: SessionRunResultMemoryPort,
+  ) {}
+
+  async reconcile(
+    sessionId: string,
+    context: RequestGuardContext,
+    signal: AbortSignal,
+  ) {
+    const session = await this.repository.get(sessionId as SessionId);
+    if (!session || session.status !== "active") throw unavailable();
+    const events = await readAll(
+      this.repository,
+      session.sessionId,
+      session.headSequence,
+    );
+    const closed = new Map(events.flatMap(({ data }) =>
+      data.type === "turn.completed" ? [[data.turnId, data.outcome] as const] : []));
+    const linked = events.flatMap(({ data }) =>
+      data.type === "run.linked"
+        ? [{ runId: data.runId, turnId: data.turnId }]
+        : []);
+    for (const item of linked) {
+      const status = await this.remote.status(item.runId, signal);
+      if (!isTerminal(status.status)) continue;
+      const closedOutcome = closed.get(item.turnId);
+      if (closedOutcome && closedOutcome !== status.status) throw unavailable();
+      if (status.status === "completed") {
+        const projectionInput = {
+          sessionId,
+          runId: item.runId,
+          terminalSequence: status.lastSequence,
+          context,
+          signal,
+        };
+        if (!await this.results.hasProjection(projectionInput)) {
+          const response = await this.remote.result(item.runId, signal);
+          if (!response.ok) throw unavailable();
+          await this.results.project({
+            ...projectionInput,
+            result: await response.json() as ModuleAiJsonValue,
+          });
+        }
+      }
+      if (!closedOutcome) {
+        await this.links.completeForRun({
+          sessionId,
+          runId: item.runId,
+          outcome: status.status,
+          context,
+        });
+      }
+    }
+  }
+}
+
+function isTerminal(
+  status: string,
+): status is "completed" | "failed" | "cancelled" {
+  return status === "completed" || status === "failed" || status === "cancelled";
+}
+
+async function readAll(
+  repository: DrizzleSessionEventRepository,
+  sessionId: SessionId,
+  throughSequence: number,
+) {
+  const result: SessionEventEnvelope[] = [];
+  let afterSequence = 0;
+  while (afterSequence < throughSequence) {
+    const page = await repository.read({
+      sessionId,
+      afterSequence,
+      throughSequence,
+      limit: 1_000,
+    });
+    if (!page.length) break;
+    result.push(...page);
+    afterSequence = page.at(-1)!.sequence;
+  }
+  return result;
+}
+
+function unavailable() {
+  return new Error("长期 Session 终态恢复暂不可用");
+}

package/template/apps/server/src/agent/session-turn-state.ts

@@ -0,0 +1,49 @@
+import type { SessionTurnId } from "./session-log/domain.js";
+import type { SessionEventEnvelope } from "./session-log/events.js";
+
+export function findOpenTurnForSource(
+  events: readonly SessionEventEnvelope[],
+  sourceId: string,
+) {
+  const completed = new Set(
+    events.flatMap(({ data }) =>
+      data.type === "turn.completed" ? [data.turnId] : [],
+    ),
+  );
+  const started = events.findLast(
+    ({ data }) =>
+      data.type === "turn.started" &&
+      data.input.sourceId === sourceId &&
+      !completed.has(data.turnId),
+  );
+  return started?.data.type === "turn.started" ? started.data.turnId : undefined;
+}
+
+export function requireTurnStarted(
+  events: readonly SessionEventEnvelope[],
+  turnId: SessionTurnId,
+) {
+  const event = events.find(
+    ({ data }) => data.type === "turn.started" && data.turnId === turnId,
+  );
+  if (!event) throw new Error("Session Turn 来源事实不存在");
+  return event;
+}
+
+export function openSteps(
+  events: readonly SessionEventEnvelope[],
+  turnId: SessionTurnId,
+) {
+  const completed = new Set(
+    events.flatMap(({ data }) =>
+      data.type === "step.completed" ? [data.stepId] : [],
+    ),
+  );
+  return events.flatMap(({ data }) =>
+    data.type === "step.started" &&
+    data.turnId === turnId &&
+    !completed.has(data.stepId)
+      ? [data.stepId]
+      : [],
+  );
+}

package/template/apps/server/src/agent/tool-audit.ts

@@ -4,7 +4,7 @@ import type {
 } from "@southwind-ai/server-sdk";
 import type { AuditEvent } from "@southwind-ai/shared";
 import { auditActor, type RequestGuardContext } from "../guards.js";
-import { debugActorAuditMetadata } from "./run-debug-authorization.js";
+import { projectedActorAuditMetadata } from "./actor-projection-audit.js";
 import type { RegisteredTool } from "./tool-registry.js";
 
 export function toolJsonBytes(value: ModuleToolInput | ModuleToolResult) {
@@ -27,7 +27,7 @@ export function toolEvent(
     module: tool.module,
     requestId: context.requestId,
     metadata: {
-      ...debugActorAuditMetadata(context.actor),
+      ...projectedActorAuditMetadata(context.actor),
       inputBytes: toolJsonBytes(input),
       outputBytes: toolJsonBytes(result),
       executionMode,
@@ -55,7 +55,7 @@ export function sandboxFailureEvent(
     module: tool.module,
     requestId: context.requestId,
     metadata: {
-      ...debugActorAuditMetadata(context.actor),
+      ...projectedActorAuditMetadata(context.actor),
       inputBytes: toolJsonBytes(input),
       executionMode: "sandbox",
       failureKind: policyDenied ? "policy-denied" : "business-failure",

package/template/apps/server/src/agent/tool-execution-receipt.ts

@@ -0,0 +1,13 @@
+import type { ModuleToolResult } from "@southwind-ai/server-sdk";
+
+export interface GovernedToolAuditReceipt {
+  readonly auditEventId: string;
+  readonly toolKey: string;
+  readonly outputSchemaKey: string;
+  readonly occurredAt: string;
+}
+
+export interface GovernedToolExecutionWithAuditReceipt {
+  readonly result: ModuleToolResult;
+  readonly auditReceipt: GovernedToolAuditReceipt;
+}

package/template/apps/server/src/agent/tool-host.ts

@@ -26,6 +26,7 @@ import {
   AgentToolApprovalPending,
 } from "./tool-approval.js";
 import type { WorkflowService } from "../workflow/service.js";
+import type { DelegatedAgentToolAuthorizationPort } from "../agent-workflow/delegated-tool-authorization.js";
 
 type ServerRuntime = ReturnType<typeof createServerRuntime>;
 
@@ -48,6 +49,7 @@ export class RestrictedAgentToolHost implements ModuleAgentToolHostPort {
     private readonly resolveActor: (
       actorId: string,
     ) => Promise<RequestActor | undefined> = async () => undefined,
+    private readonly delegatedAuthorization?: DelegatedAgentToolAuthorizationPort,
   ) {
     this.#features = modules.flatMap(({ features }) => features);
     const handlers = new Map(
@@ -162,6 +164,30 @@ export class RestrictedAgentToolHost implements ModuleAgentToolHostPort {
         "Agent Operation 当前无权继续执行",
       );
     }
+    const delegation = binding.authorizationSnapshot.delegation;
+    if (delegation) {
+      if (!this.delegatedAuthorization) {
+        throw new AgentToolHostError(
+          "TOOL_DENIED",
+          "子 Agent 委派授权复核未装配",
+        );
+      }
+      try {
+        await this.delegatedAuthorization.authorize({
+          runId: invocation.runId,
+          operationKey: binding.operationKey,
+          toolKey: invocation.toolKey,
+          delegation,
+          context,
+          signal: AbortSignal.timeout(10_000),
+        });
+      } catch {
+        throw new AgentToolHostError(
+          "TOOL_DENIED",
+          "子 Agent 委派授权已撤销或不可用",
+        );
+      }
+    }
     const definition = this.tools.definition(invocation.toolKey);
     if (!definition) {
       throw new AgentToolHostError("TOOL_DENIED", "Agent Tool 不存在");
@@ -221,14 +247,25 @@ function sameOperationAuthorization(
   binding: Awaited<ReturnType<AgentRunAuthorizationStore["authorizeTool"]>>,
 ): boolean {
   const snapshot = binding.authorizationSnapshot;
+  const allowedToolKeys = [...new Set(snapshot.allowedToolKeys)];
+  const toolsWithinOperation = allowedToolKeys.every((key) =>
+    definition.allowedToolKeys.includes(key),
+  );
+  const toolPolicyMatches = snapshot.delegation
+    ? toolsWithinOperation &&
+      allowedToolKeys.length === snapshot.allowedToolKeys.length &&
+      definition.requiredCapabilities.includes(
+        snapshot.delegation.capabilityKey,
+      )
+    : definition.allowedToolKeys.length === snapshot.allowedToolKeys.length &&
+      definition.allowedToolKeys.every(
+        (key, index) => key === snapshot.allowedToolKeys[index],
+      );
   return (
     definition.permissionKey === snapshot.permissionKey &&
     definition.featureKey === snapshot.featureKey &&
     networkMode === snapshot.toolNetworkMode &&
-    definition.allowedToolKeys.length === snapshot.allowedToolKeys.length &&
-    definition.allowedToolKeys.every(
-      (key, index) => key === snapshot.allowedToolKeys[index],
-    )
+    toolPolicyMatches
   );
 }