@sema-agent/client-core 0.104.0 → 0.105.0

package/dist/permissionsDeclaration.d.ts

@@ -39,6 +39,24 @@ export interface PermissionsDeclarationBuckets {
 export interface PermissionsDeclaration {
     permissions?: PermissionsDeclarationBuckets;
 }
+export type SettingsRuleLayerOrigin = keyof typeof SETTINGS_SOURCE_TIERS;
+export interface TightenRuleContribution {
+    readonly rule: string;
+    readonly origin: WireRuleOrigin;
+}
+export interface LayeredTightenEntry {
+    readonly rule: string;
+    readonly layer: SettingsRuleLayerOrigin;
+}
+export type TightenWireEntry = string | LayeredTightenEntry;
+export interface HostPermissionsBuckets {
+    deny?: TightenWireEntry[];
+    ask?: TightenWireEntry[];
+    allow?: string[];
+}
+export interface HostPermissionsDeclaration {
+    permissions?: HostPermissionsBuckets;
+}
 export declare const PERMISSIONS_KEPT_REASONS: readonly ["allow_capability_off", "settings_read_not_clean", "empty_rule", "paren_in_tool_name", "retired_tool_name", "unprefixed_namespaced_name", "incomplete_protocol_name", "unminted_protocol_segment", "home_relative_path", "compile_refused", "content_form_not_grantable", "content_form_never_matches", "judge_failed", "duplicate", "voids_allow_list"];
 export type PermissionsKeptReason = (typeof PERMISSIONS_KEPT_REASONS)[number];
 export interface PermissionsKeptRule {
@@ -86,8 +104,12 @@ export interface AssembledRuleRow {
     readonly origin?: WireRuleOrigin;
     readonly fate: AssembledRuleFate;
 }
+export interface LayeredTightenSources {
+    readonly deny: readonly TightenRuleContribution[];
+    readonly ask: readonly TightenRuleContribution[];
+}
 export declare function permissionsDeclaration(input: PermissionsDeclarationInput, caps: PermissionsAllowGrantReading): PermissionsDeclaration;
-export declare function projectPermissionsDeclaration(input: PermissionsDeclarationInput, caps: PermissionsAllowGrantReading, projection: RulePortsProjection): PermissionsDeclaration;
+export declare function projectPermissionsDeclaration(input: PermissionsDeclarationInput, caps: PermissionsAllowGrantReading, projection: RulePortsProjection, layered?: LayeredTightenSources): HostPermissionsDeclaration;
 export declare function permissionsDeclarationReport(input: PermissionsDeclarationInput, caps: PermissionsAllowGrantReading): PermissionsDeclarationReport;
 export declare function assembledRuleRows(input: PermissionsDeclarationInput, caps: PermissionsAllowGrantReading): readonly AssembledRuleRow[];
 export interface PermissionsAllowKeptFacts {

package/dist/permissionsDeclaration.js

@@ -244,45 +244,60 @@ function allowListVoiders(sent) {
         return 'unknown';
     }
 }
-function judgeBucket(raw, behavior, originOf, cli, settingsGate, allowForm = 'grant', dropWire, owned = [], serverVersion) {
+function judgeBucket(raw, behavior, originOf, cli, settingsGate, allowForm = 'grant', dropWire, owned = [], serverVersion, layeredFrom) {
     const firstSlot = new Map();
     for (const s of raw)
         if (!firstSlot.has(s.rule))
             firstSlot.set(s.rule, s);
     const groups = WIRE_RULE_TRUST_ORDER.map(() => []);
     const rankOf = (origin) => WIRE_RULE_TRUST_ORDER.indexOf(origin);
-    if (originOf !== undefined) {
-        for (const [r, origin] of originOf) {
+    const pairs = layeredFrom !== undefined ? layeredFrom.map((c) => [c.rule, c.origin]) : originOf;
+    const known = new Set();
+    if (pairs !== undefined) {
+        for (const [r, origin] of pairs) {
             const rank = rankOf(origin);
-            if (rank >= 0 && typeof r === 'string' && firstSlot.has(r))
+            if (rank >= 0 && typeof r === 'string' && firstSlot.has(r)) {
                 appendOwnElement(groups[rank], r);
+                known.add(r);
+            }
         }
     }
-    const unknownOrigin = [...firstSlot.keys()].filter((r) => originOf === undefined || rankOf(originOf.get(r)) < 0);
+    const unknownOrigin = [...firstSlot.keys()].filter((r) => !known.has(r));
     const fateOfRule = new Map();
     const sent = [];
+    const sentLayers = [];
+    const sentIds = [];
     const winnerOf = new Map();
     const cliFates = cli === undefined ? [] : [...cli.fates];
-    const place = (slot, fate) => {
+    const layerOf = (origin) => layeredFrom !== undefined && origin !== undefined && Object.hasOwn(SETTINGS_SOURCE_TIERS, origin) ? origin : undefined;
+    const place = (slot, fate, origin) => {
         if (!fate.sent)
             return fate;
         const dropped = dropWire?.(fate.wire);
         if (dropped !== undefined)
             return kept(dropped);
-        if (winnerOf.has(fate.wire))
+        const layer = layerOf(origin);
+        const id = layeredFrom === undefined ? fate.wire : JSON.stringify([layer ?? null, fate.wire]);
+        if (winnerOf.has(id))
             return kept('duplicate');
-        winnerOf.set(fate.wire, slot);
+        winnerOf.set(id, slot);
         appendOwnElement(sent, fate.wire);
+        appendOwnElement(sentLayers, layer);
+        appendOwnElement(sentIds, id);
         return fate;
     };
     const appendGroup = (group, origin) => {
         const held = settingsGate !== undefined && !outsideSettingsFiles(origin);
         const fates = held ? group.map(() => kept(settingsGate)) : judgeList(group, behavior, allowForm, serverVersion);
-        group.forEach((r, k) => fateOfRule.set(r, place(firstSlot.get(r), fates[k])));
+        group.forEach((r, k) => {
+            const f = place(firstSlot.get(r), fates[k], origin);
+            if (!fateOfRule.has(r))
+                fateOfRule.set(r, f);
+        });
     };
     WIRE_RULE_TRUST_ORDER.forEach((origin, rank) => {
         if (origin === 'cliArg' && cli !== undefined)
-            cli.slots.forEach((s, k) => (cliFates[k] = place(s, cliFates[k])));
+            cli.slots.forEach((s, k) => (cliFates[k] = place(s, cliFates[k], 'cliArg')));
         appendGroup(groups[rank], origin);
     });
     const ownedFates = owned.map((fate, k) => place({ rule: fate.sent ? fate.wire : '', list: 'allow', at: -1 - k }, fate));
@@ -293,7 +308,7 @@ function judgeBucket(raw, behavior, originOf, cli, settingsGate, allowForm = 'gr
             return f;
         return f.sent || f.reason === 'duplicate' ? kept('duplicate') : f;
     });
-    return { sent, fates: [...fates, ...cliFates], winnerOf, ownedFates };
+    return { sent, sentLayers, sentIds, fates: [...fates, ...cliFates], winnerOf, ownedFates };
 }
 function clientOwnedFate(server) {
     if (server.length === 0)
@@ -312,7 +327,7 @@ function ownField(obj, key, where) {
         throw malformed(`${WHO}: ${where}${key} 只在原型链上,不是自有字段 —— 拒绝读取(请交普通对象)。`);
     return undefined;
 }
-function ruleList(v, key) {
+function ruleList(v, key, tighten = false) {
     if (v === undefined || v === null)
         return undefined;
     if (!Array.isArray(v))
@@ -326,6 +341,9 @@ function ruleList(v, key) {
             continue;
         }
         const r = v[i];
+        if (tighten && r !== null && typeof r === 'object') {
+            throw malformed(`${WHO}: ${key}[${i}] 是对象(带出处层的条目形)—— 本口只收规则串:收紧方向的条目不静默丢,拒绝装配(带层条目由宿主设置入口在能力位恰真时铸)。`);
+        }
         if (typeof r === 'string')
             appendOwnElement(out, r);
     }
@@ -348,17 +366,17 @@ function originMap(v, key) {
     return snap;
 }
 const slotsOf = (list, name) => (list ?? []).map((rule, at) => ({ rule, list: name, at }));
-function assemble(input, caps, projection) {
+function assemble(input, caps, projection, layered) {
     const outer = activeRulePortsProjection;
     activeRulePortsProjection = projection;
     try {
-        return assembleNow(input, caps);
+        return assembleNow(input, caps, layered);
     }
     finally {
         activeRulePortsProjection = outer;
     }
 }
-function assembleNow(input, caps) {
+function assembleNow(input, caps, layered) {
     let read;
     try {
         read = readAssemblyInput(input, caps);
@@ -367,7 +385,7 @@ function assembleNow(input, caps) {
         throw asAssemblyRefusal(e, 'input_malformed', WHO);
     }
     try {
-        return judgeAssembly(read, caps);
+        return judgeAssembly(read, caps, layered);
     }
     catch (e) {
         throw asAssemblyRefusal(e, 'judge_unanswerable', WHO);
@@ -377,10 +395,10 @@ function readAssemblyInput(input, caps) {
     if (input === null || typeof input !== 'object' || Array.isArray(input)) {
         throw malformed(`${WHO}: 入参必须是对象 —— 收到 ${input === null ? 'null' : Array.isArray(input) ? 'array' : `typeof=${typeof input}`}。`);
     }
-    const deny = ruleList(ownField(input, 'deny', ''), 'deny');
-    const ask = ruleList(ownField(input, 'ask', ''), 'ask');
+    const deny = ruleList(ownField(input, 'deny', ''), 'deny', true);
+    const ask = ruleList(ownField(input, 'ask', ''), 'ask', true);
     const allow = ruleList(ownField(input, 'allow', ''), 'allow');
-    const cliDeny = ruleList(ownField(input, 'cliDeny', ''), 'cliDeny');
+    const cliDeny = ruleList(ownField(input, 'cliDeny', ''), 'cliDeny', true);
     const ownedServers = [...new Set(ruleList(ownField(input, 'clientOwnedServers', ''), 'clientOwnedServers') ?? [])];
     const originsRaw = ownField(input, 'origins', '');
     let origins = {};
@@ -398,19 +416,19 @@ function readAssemblyInput(input, caps) {
     const serverVersion = typeof versionRaw === 'string' ? versionRaw : undefined;
     return { deny, ask, allow, cliDeny, ownedServers, origins, gate, serverVersion };
 }
-function judgeAssembly(read, caps) {
+function judgeAssembly(read, caps, layered) {
     const { deny, ask, allow, cliDeny, ownedServers, origins, gate, serverVersion } = read;
     const cliSlots = slotsOf(cliDeny, 'cliDeny');
     const cli = cliDeny === undefined ? undefined : { slots: cliSlots, fates: judgeList(cliDeny, 'deny', 'grant', serverVersion) };
     const denySlots = slotsOf(deny, 'deny');
     const askSlots = slotsOf(ask, 'ask');
     const allowSlots = slotsOf(allow, 'allow');
-    const denyJ = judgeBucket(denySlots, 'deny', origins.deny, cli, undefined, 'grant', undefined, [], serverVersion);
-    const askJ = judgeBucket(askSlots, 'ask', origins.ask, undefined, undefined, 'grant', undefined, [], serverVersion);
+    const denyJ = judgeBucket(denySlots, 'deny', origins.deny, cli, undefined, 'grant', undefined, [], serverVersion, layered?.deny);
+    const askJ = judgeBucket(askSlots, 'ask', origins.ask, undefined, undefined, 'grant', undefined, [], serverVersion, layered?.ask);
     const allowForm = allowWireForm(caps) === 'layer' ? 'layer' : 'grant';
     const settingsGate = gate === 'settings_read_not_clean' ? 'settings_read_not_clean' : undefined;
     let allowJ = gate === 'capability_off'
-        ? { sent: [], fates: allowSlots.map(() => kept('allow_capability_off')), winnerOf: new Map(), ownedFates: ownedServers.map(() => kept('allow_capability_off')) }
+        ? { sent: [], sentLayers: [], sentIds: [], fates: allowSlots.map(() => kept('allow_capability_off')), winnerOf: new Map(), ownedFates: ownedServers.map(() => kept('allow_capability_off')) }
         : judgeBucket(allowSlots, 'allow', origins.allow, undefined, settingsGate, allowForm, undefined, ownedServers.map(clientOwnedFate));
     if (gate !== 'capability_off' && allowForm === 'layer' && allowJ.sent.length > 0) {
         const voiders = allowListVoiders(allowJ.sent);
@@ -426,6 +444,17 @@ function judgeAssembly(read, caps) {
         buckets.ask = [...askJ.sent];
     if (allowJ.sent.length > 0)
         buckets.allow = [...allowJ.sent];
+    const entriesOf = (j) => j.sent.map((wire, i) => {
+        const layer = j.sentLayers[i];
+        return layer === undefined ? wire : Object.freeze({ rule: wire, layer });
+    });
+    const wireBuckets = {};
+    if (denyJ.sent.length > 0)
+        wireBuckets.deny = entriesOf(denyJ);
+    if (askJ.sent.length > 0)
+        wireBuckets.ask = entriesOf(askJ);
+    if (allowJ.sent.length > 0)
+        wireBuckets.allow = [...allowJ.sent];
     const keptRows = [];
     const rewritten = [];
     const ruleRows = [];
@@ -458,21 +487,22 @@ function judgeAssembly(read, caps) {
                 });
             }
         });
-        for (const wire of j.sent) {
-            const winner = j.winnerOf.get(wire);
+        j.sent.forEach((wire, i) => {
+            const winner = j.winnerOf.get(j.sentIds[i]);
             if (winner.at < 0)
-                continue;
+                return;
             if (winner.rule !== wire)
                 appendOwnElement(rewritten, { from: winner.rule, to: wire, bucket });
-        }
+        });
     }
-    return { buckets, report: { kept: keptRows, rewritten, ...(clientOwned.length > 0 ? { clientOwned } : {}) }, rows: ruleRows };
+    return { buckets, wireBuckets, report: { kept: keptRows, rewritten, ...(clientOwned.length > 0 ? { clientOwned } : {}) }, rows: ruleRows };
 }
 export function permissionsDeclaration(input, caps) {
     return declarationOf(assemble(input, caps));
 }
-export function projectPermissionsDeclaration(input, caps, projection) {
-    return declarationOf(assemble(input, caps, projection));
+export function projectPermissionsDeclaration(input, caps, projection, layered) {
+    const { wireBuckets } = assemble(input, caps, projection, layered);
+    return Object.keys(wireBuckets).length > 0 ? { permissions: wireBuckets } : {};
 }
 function declarationOf({ buckets }) {
     return Object.keys(buckets).length > 0 ? { permissions: buckets } : {};

package/dist/planReviewCardFacts.d.ts

@@ -0,0 +1,116 @@
+export type PlanBodyUnknownCause = 'not_observed' | 'gate_unidentified' | 'gate_moved' | 'unreadable' | 'ambiguous_call' | 'malformed_frame' | 'conflicting_claims' | 'not_presented' | 'not_carried';
+export type PlanReviewBody = {
+    readonly kind: 'shown';
+    readonly markdown: string;
+} | {
+    readonly kind: 'marked';
+    readonly literal: string;
+} | {
+    readonly kind: 'too_large';
+    readonly length: number;
+} | {
+    readonly kind: 'unknown';
+    readonly cause: PlanBodyUnknownCause;
+};
+export interface PlanReviewCardFacts {
+    readonly taskId: string;
+    readonly checkpointId?: string;
+    readonly body: PlanReviewBody;
+}
+export declare function planReviewBodyOf(text: string): Exclude<PlanReviewBody, {
+    kind: 'unknown';
+}>;
+export declare function mintPlanReviewCardFacts(taskId: string, checkpointId: string | undefined, body: PlanReviewBody): PlanReviewCardFacts;
+export declare function unknownBody(cause: PlanBodyUnknownCause): PlanReviewBody;
+export declare function planReviewCardFactsFrom(v: {} | null | undefined): PlanReviewCardFacts | undefined;
+export declare function samePlanReviewCardFacts(a: PlanReviewCardFacts, b: PlanReviewCardFacts): boolean;
+export declare function isPlanReviewPark(result: unknown): result is {
+    taskId: string;
+    sessionId?: string;
+};
+export declare function pausedCheckpointIdOf(carrier: {} | null | undefined): string | undefined;
+export type PlanClaim = {
+    readonly kind: 'text';
+    readonly text: string;
+} | {
+    readonly kind: 'cause';
+    readonly cause: PlanBodyUnknownCause;
+};
+interface PresentedCall {
+    readonly plan?: string;
+}
+interface ClaimWindow {
+    presented: PresentedCall[];
+    malformed: boolean;
+    ambiguous: boolean;
+    unreadable: boolean;
+}
+interface PlanReviewGateEntry {
+    readonly checkpointId: string;
+    readonly facts: PlanReviewCardFacts;
+    readonly claim: PlanClaim;
+    readonly highWater?: string;
+    readonly generation: number;
+}
+interface PlanReviewRunRecord {
+    readonly open: Set<string>;
+    readonly settled: Set<string>;
+    window: ClaimWindow;
+    sawPlanFrame: boolean;
+    claimAtMarker?: PlanClaim | undefined;
+    claimGate?: string | undefined;
+    dirty: boolean;
+    gate?: PlanReviewGateEntry;
+    generation: number;
+    cardIssued: boolean;
+}
+export declare function _resetPlanReviewRunsForTest(): void;
+export interface PlanReviewFactsTicket {
+    readonly sessionKey: string;
+    readonly taskId: string;
+    readonly generation: number;
+}
+export declare function beginPlanReviewFactsRead(sessionKey: string, taskId: string): PlanReviewFactsTicket;
+export declare function commitPlanReviewFacts(ticket: PlanReviewFactsTicket, facts: PlanReviewCardFacts, claim: PlanClaim, highWater?: string): PlanReviewCardFacts | undefined;
+export declare function samePlanClaim(a: PlanClaim, b: PlanClaim): boolean;
+export declare function registeredPlanReviewCardFacts(sessionKey: string, taskId: string, checkpointId: string): PlanReviewCardFacts | undefined;
+export interface PlanReviewCurrentGate {
+    readonly checkpointId: string;
+    readonly facts: PlanReviewCardFacts;
+    readonly generation: number;
+}
+export declare function currentPlanReviewGateOf(sessionKey: string, taskId: string): PlanReviewCurrentGate | undefined;
+export declare function planReviewRunGeneration(sessionKey: string, taskId: string): number;
+export declare function notePlanReviewCardIssued(sessionKey: string, taskId: string): boolean;
+export declare function planReviewGateHighWaterOf(sessionKey: string, taskId: string, checkpointId: string): string | undefined;
+export interface PlanBodyClaimLeg {
+    taskId?: string;
+    readonly buffer: Array<{
+        readonly frame: object;
+        readonly subFlow: boolean;
+    }>;
+    overflow: boolean;
+    unreadable: boolean;
+}
+export declare function openPlanBodyClaimLeg(): PlanBodyClaimLeg;
+export declare function stepPlanBodyClaim(leg: PlanBodyClaimLeg, frame: object, subFlow: boolean): void;
+export declare function planReviewParkFacts(leg: PlanBodyClaimLeg, result: {} | null | undefined): PlanReviewCardFacts | undefined;
+export interface PlanReviewFactsTaken {
+    readonly sessionKey: string;
+    readonly taskId: string;
+    readonly facts: PlanReviewCardFacts;
+    readonly generation: number;
+}
+export declare function planReviewFactsCurrent(taken: PlanReviewFactsTaken): boolean;
+export interface PlanGateRowRead {
+    readonly ok: boolean;
+    readonly atPlanGate: boolean;
+    readonly checkpointId?: string;
+}
+export declare function planGateRowReadOf(row: {} | null | undefined): PlanGateRowRead;
+export type PlanReviewLedgerFold = PlanReviewRunRecord;
+export declare function openPlanReviewLedgerFold(): PlanReviewLedgerFold;
+export declare function stepPlanReviewLedgerFold(fold: PlanReviewLedgerFold, frame: object, subFlow: boolean): PlanReviewLedgerFold;
+export declare function planReviewLedgerClaimOf(fold: PlanReviewLedgerFold): PlanClaim | undefined;
+export declare function isPlanReviewClaimFrame(frame: object): boolean;
+export {};