@sema-agent/client-core 0.90.0 → 0.92.0

package/dist/liveModelCatalog.js

@@ -26,10 +26,58 @@ export function getLiveModelCatalog() {
 export function normalizeLiveModelRef(ref) {
     if (!catalog || !ref)
         return ref;
-    if (catalog.models.some(m => m.name === ref))
+    const row = liveModelRowOf(catalog, ref);
+    if (row === undefined)
         return ref;
-    const row = catalog.models.find(m => typeof m.id === 'string' && m.id === ref);
-    return row?.name || ref;
+    const name = ownDataOf(row, 'name');
+    return typeof name === 'string' && name ? name : ref;
+}
+function ownDataOf(o, key) {
+    try {
+        const d = Object.getOwnPropertyDescriptor(o, key);
+        return d !== undefined && 'value' in d ? d.value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function liveModelRowOf(cat, ref) {
+    const models = ownDataOf(cat, 'models');
+    if (!Array.isArray(models))
+        return undefined;
+    const n = ownDataOf(models, 'length');
+    if (typeof n !== 'number' || !Number.isSafeInteger(n) || n < 0)
+        return undefined;
+    const rows = [];
+    for (let i = 0; i < n; i += 1) {
+        const row = ownDataOf(models, String(i));
+        if (row !== null && typeof row === 'object')
+            rows.push(row);
+    }
+    return rows.find((row) => ownDataOf(row, 'name') === ref) ?? rows.find((row) => ownDataOf(row, 'id') === ref);
+}
+export function imageVisionOf(model, catalog = getLiveModelCatalog()) {
+    try {
+        if (model !== undefined && typeof model !== 'string')
+            return 'unknown';
+        if (catalog === null || typeof catalog !== 'object' || Array.isArray(catalog))
+            return 'unknown';
+        let target = model !== undefined && model.length > 0 ? model : undefined;
+        if (target === undefined) {
+            const def = ownDataOf(catalog, 'default');
+            target = typeof def === 'string' && def.length > 0 ? def : undefined;
+        }
+        if (target === undefined)
+            return 'unknown';
+        const row = liveModelRowOf(catalog, target);
+        if (row === undefined)
+            return 'unknown';
+        const vision = ownDataOf(row, 'vision');
+        return vision === true ? 'yes' : vision === false ? 'no' : 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
 }
 export function liveDefaultModelName() {
     if (!catalog?.default)

package/dist/mcpLiveness.js

@@ -1,4 +1,5 @@
-export const MCP_LIVENESS_STATES = Object.freeze(['reachable', 'unreachable', 'unknown']);
+import { CORE_MCP_LIVENESS_STATES } from './generated/engineFactTables.js';
+export const MCP_LIVENESS_STATES = CORE_MCP_LIVENESS_STATES;
 void MCP_LIVENESS_STATES;
 void true;
 void true;

package/dist/memoryVerbsWire.d.ts

@@ -19,7 +19,7 @@ export interface MemoryFacade {
         signal?: AbortSignal;
     }): Promise<MemoryOriginClearReceipt>;
 }
-export declare const MEMORY_VERB_REFUSAL_CAUSES: readonly ["face_absent", "client_too_old", "unreadable_request", "store_absent", "operator_only", "unauthorized", "service_token_required", "id_invalid", "request_id_required", "body_shape", "query_invalid", "selector_invalid", "evidence_unavailable", "selector_mismatch", "census_incomplete", "clear_unattributed", "clear_invalid", "clear_not_marked", "clear_challenged", "clear_conflict", "clear_pending"];
+export declare const MEMORY_VERB_REFUSAL_CAUSES: readonly ["face_absent", "client_too_old", "unreadable_request", "store_absent", "operator_only", "operators_unconfigured", "unauthorized", "service_token_required", "id_invalid", "request_id_required", "body_shape", "query_invalid", "selector_invalid", "evidence_unavailable", "selector_mismatch", "census_incomplete", "clear_unattributed", "clear_invalid", "clear_not_marked", "clear_challenged", "clear_conflict", "clear_pending"];
 export type MemoryVerbRefusalCause = (typeof MEMORY_VERB_REFUSAL_CAUSES)[number];
 export declare const MEMORY_VERB_UNKNOWN_WHYS: readonly ["no_verdict", "server_fault", "control_plane_corrupt", "clear_unknown", "clear_failed", "result_unreadable", "unsupported_version", "identity_mismatch", "unclassified"];
 export type MemoryVerbUnknownWhy = (typeof MEMORY_VERB_UNKNOWN_WHYS)[number];

package/dist/memoryVerbsWire.js

@@ -8,6 +8,7 @@ export const MEMORY_VERB_REFUSAL_CAUSES = Object.freeze([
     'unreadable_request',
     'store_absent',
     'operator_only',
+    'operators_unconfigured',
     'unauthorized',
     'service_token_required',
     'id_invalid',
@@ -51,6 +52,8 @@ export function classifyMemoryFailure(e) {
             return refusedBy('unauthorized', message);
         case 'auth.operator_only':
             return refusedBy('operator_only', message);
+        case 'capability.operator_principals_required':
+            return refusedBy('operators_unconfigured', message);
         case 'auth.service_token_required':
             return refusedBy('service_token_required', message);
         case 'capability.memory_engine_required':

package/dist/model/catalog.js

@@ -1,4 +1,5 @@
 import { PROVIDER_PRESETS } from './providerPresets.js';
+import { SETTINGS_MODEL_API_WORDS } from '../generated/settingsSchemaTables.js';
 export const CATALOG_SCHEMA_VERSION_MIN = 1;
 export const CATALOG_SCHEMA_VERSION_MAX = 1;
 export function isSupportedCatalogSchemaVersion(v) {
@@ -15,7 +16,7 @@ function isProviderRow(v) {
         r.id.length > 0 &&
         typeof r.name === 'string' &&
         typeof r.baseUrl === 'string' &&
-        (r.api === 'anthropic-messages' || r.api === 'openai-completions') &&
+        typeof r.api === 'string' && SETTINGS_MODEL_API_WORDS.includes(r.api) &&
         typeof r.authEnv === 'string' &&
         Array.isArray(r.models));
 }

package/dist/model/providerPresets.d.ts

@@ -1,3 +1,5 @@
+import type { SETTINGS_MODEL_API_WORDS } from '../generated/settingsSchemaTables.js';
+export type ModelApiWord = (typeof SETTINGS_MODEL_API_WORDS)[number];
 export type PresetModel = {
     id: string;
     contextWindow: number;
@@ -8,7 +10,7 @@ export type ProviderPreset = {
     id: string;
     name: string;
     baseUrl: string;
-    api: 'anthropic-messages' | 'openai-completions';
+    api: ModelApiWord;
     authEnv: string;
     models: PresetModel[];
     modelViaFamily?: boolean;

package/dist/model/tierVocabulary.d.ts

@@ -1,4 +1,5 @@
-export type Tier = 'ultra' | 'max' | 'pro' | 'flash' | 'lite';
+import { CORE_DEFAULT_TIER_ORDER } from '../generated/engineFactTables.js';
+export type Tier = (typeof CORE_DEFAULT_TIER_ORDER)[number];
 export declare const TIER_ORDER: readonly Tier[];
 export declare const SURFACED_TIERS: readonly Tier[];
 export declare const CC_TIER_ALIASES: Readonly<Record<string, Tier>>;

package/dist/model/tierVocabulary.js

@@ -1,12 +1,7 @@
-export const TIER_ORDER = Object.freeze(['ultra', 'max', 'pro', 'flash', 'lite']);
+import { CORE_CC_MODEL_TIER_ALIASES, CORE_DEFAULT_TIER_ORDER } from '../generated/engineFactTables.js';
+export const TIER_ORDER = CORE_DEFAULT_TIER_ORDER;
 export const SURFACED_TIERS = ['max', 'pro', 'flash', 'lite'];
-export const CC_TIER_ALIASES = {
-    fable: 'max',
-    mythos: 'max',
-    opus: 'pro',
-    sonnet: 'flash',
-    haiku: 'lite',
-};
+export const CC_TIER_ALIASES = CORE_CC_MODEL_TIER_ALIASES;
 export const DEFAULT_TIER = 'pro';
 export const TIER_BLURBS = {
     ultra: 'reserved above max — binds when a stronger model lands',

package/dist/peerFrames.js

@@ -1,5 +1,5 @@
 import { applyDisplayFace, LEGACY_NAME_FACE } from './displayUntrusted.js';
-import { CORE_ENGINE_AUTHORITY_ENVELOPE_TAGS } from './generated/engineFactTables.js';
+import { CORE_ENGINE_AUTHORITY_ENVELOPE_TAGS, CORE_PERMISSION_MODE_CLASSES } from './generated/engineFactTables.js';
 const WIRE_KEY_FROM = 'from';
 const WIRE_KEY_BODY = 'body';
 const WIRE_KEY_KIND = 'kind';
@@ -21,7 +21,7 @@ export const AGENT_MESSAGE_TAG = 'agent-message';
 export const CROSS_SESSION_MESSAGE_TAG = 'cross-session-message';
 export const PEER_FRAME_LANES = Object.freeze(['agent_message', 'cross_session_message', 'cross_session_notice']);
 export const CROSS_SESSION_NOTICE_KINDS = Object.freeze(['delivery_notice', 'idle_notice']);
-export const PEER_MODE_CLASSES = Object.freeze(['bypass', 'prompting']);
+export const PEER_MODE_CLASSES = CORE_PERMISSION_MODE_CLASSES;
 function dataProp(o, key) {
     if (o === null || typeof o !== 'object')
         return undefined;

package/dist/permissionRuleIssue.d.ts

@@ -1,3 +1,3 @@
 export declare const PERMISSION_RULE_ISSUE_CODES: readonly string[];
 export declare const RETIRED_PERMISSION_RULE_ISSUE_CODES: readonly string[];
-export declare function permissionRuleIssueDetail(code: unknown, message: unknown): string;
+export declare function permissionRuleIssueDetail(code: unknown, message: unknown, rule?: string): string;

package/dist/permissionRuleIssue.js

@@ -3,15 +3,15 @@ export const PERMISSION_RULE_ISSUE_CODES = Object.freeze([
     'invalid.empty_tool',
     'invalid.paren',
     'invalid.param_split',
-    'invalid.allow_param_rule',
     'invalid.primary_field',
     'invalid.cap_exceeded',
-    'unsupported.bash_prefix',
+    'unsupported.allow',
+    'invalid.behavior',
     'invalid.command_rule',
+    'invalid.entry_type',
     'unsupported.param_unknown',
     'unsupported.param_non_scalar',
     'unsupported.tool_unknown',
-    'unsupported.file_glob',
     'unsupported.path_base',
     'unsupported.mcp_paren',
     'unsupported.covering_paren',
@@ -21,22 +21,44 @@ const ISSUE_MESSAGE_MAX = 200;
 const ISSUE_SENTENCES = Object.freeze({
     'invalid.empty_tool': 'this rule is invalid: it names no tool',
     'invalid.paren': 'this rule is invalid: its parentheses do not parse (escape a literal one as \\( or \\))',
-    'invalid.param_split': 'this rule is invalid: the part before the colon is not a parameter name',
-    'invalid.allow_param_rule': 'this rule is invalid: an allow rule cannot carry a parameter pattern — only bare tool rules auto-allow',
+    'invalid.param_split': 'this rule is invalid: its parentheses do not hold a parameter rule written name:pattern',
     'invalid.primary_field': "this rule is invalid: it patterns the tool's primary field, which matches the whole trimmed string rather than a prefix",
     'invalid.cap_exceeded': 'this rule set is invalid: it is over one of the deployment caps (rule count, rule length, pattern length, or star count)',
+    'invalid.behavior': 'this rule is invalid: its behavior is neither deny nor ask, so it would never fire',
     'invalid.command_rule': 'this rule is invalid: the command pattern was rejected by the command-rule validator',
-    'unsupported.bash_prefix': 'a standing approval for a command belongs in the persisted-rule store, so this allow rule is not supported here (deny and ask rules with the same shape do compile)',
+    'invalid.entry_type': 'this allow list is invalid: it must be a list of rule strings, and it or one of its entries is not a string',
+    'unsupported.allow': 'an allow rule is not supported in a rule set that only says deny or ask — a standing approval belongs on the allow list instead',
     'unsupported.param_unknown': 'this parameter rule is not supported: the tool carries no such parameter, so it could never match',
     'unsupported.param_non_scalar': 'this parameter rule is not supported: that parameter holds an object or an array, so it could never match',
     'unsupported.tool_unknown': "this rule is not supported on this leg: the resolver it supplied does not know the tool, so the rule's face cannot be checked",
-    'unsupported.file_glob': 'a standing approval by path belongs in the consent store, so this allow rule is not supported here (deny and ask path rules do compile)',
     'unsupported.path_base': 'this path rule is not supported as spelled: it needs a base this policy was not given, so it would reach nothing and is refused rather than compiled',
     'unsupported.mcp_paren': 'a parenthesised parameter rule is not supported on an MCP tool name',
     'unsupported.covering_paren': 'a parenthesised parameter rule is not supported on a covering protocol name — the parameter grammar is keyed by an exact tool name, so no mounted tool could ever bear it',
+    'invalid.allow_param_rule': 'this rule is invalid: an allow rule cannot carry a parameter pattern — only bare tool rules auto-allow',
+    'unsupported.bash_prefix': 'a standing approval for a command belongs in the persisted-rule store, so this allow rule is not supported here (deny and ask rules with the same shape do compile)',
+    'unsupported.file_glob': 'a standing approval by path belongs in the consent store, so this allow rule is not supported here (deny and ask path rules do compile)',
 });
-export function permissionRuleIssueDetail(code, message) {
-    const known = typeof code === 'string' && Object.hasOwn(ISSUE_SENTENCES, code) ? ISSUE_SENTENCES[code] : undefined;
+const PARAM_SPLIT_WITH_COLON = 'this rule is invalid: a parameter rule is written name:pattern, and the name before the colon or the pattern after it is empty';
+const PARAM_SPLIT_NO_COLON = 'this rule is invalid: there is no colon inside the parentheses, so this is not a parameter rule (a parameter rule is written name:pattern)';
+function colonInsideParens(rule) {
+    if (typeof rule !== 'string')
+        return undefined;
+    for (let i = 0; i < rule.length; i += 1) {
+        const ch = rule[i];
+        if (ch === '\\') {
+            i += 1;
+            continue;
+        }
+        if (ch === '(')
+            return rule.indexOf(':', i + 1) !== -1;
+    }
+    return undefined;
+}
+export function permissionRuleIssueDetail(code, message, rule) {
+    const colon = code === 'invalid.param_split' ? colonInsideParens(rule) : undefined;
+    const known = colon !== undefined
+        ? colon ? PARAM_SPLIT_WITH_COLON : PARAM_SPLIT_NO_COLON
+        : typeof code === 'string' && Object.hasOwn(ISSUE_SENTENCES, code) ? ISSUE_SENTENCES[code] : undefined;
     const text = typeof message === 'string' && message.length > 0
         ? capForDisplay(message, ISSUE_MESSAGE_MAX)
         : '';

package/dist/permissionsAllowGrantCapability.d.ts

@@ -12,6 +12,7 @@ export declare function noteEngineCapsForPermissionsAllowGrant(baseUrl: string,
 }): void;
 export declare function observedPermissionsAllowGrant(baseUrl?: string | undefined): PermissionsAllowGrantReading;
 export declare function permissionsAllowGrantAvailable(reading: PermissionsAllowGrantReading): boolean;
-export declare function permissionsAllowGrantDoctorDetail(reading: PermissionsAllowGrantReading): string;
+export declare function allowRulesGate(reading: PermissionsAllowGrantReading, settingsRead: 'clean' | 'partial' | 'unreadable' | undefined): 'open' | 'capability_off' | 'settings_read_not_clean';
+export declare function permissionsAllowGrantDoctorDetail(reading: PermissionsAllowGrantReading, settingsRead?: 'clean' | 'partial' | 'unreadable'): string;
 export declare function forgetPermissionsAllowGrantReading(baseUrl: string | undefined): void;
 export declare function __resetPermissionsAllowGrantReadingsForTests(): void;

package/dist/permissionsAllowGrantCapability.js

@@ -44,6 +44,11 @@ export function permissionsAllowGrantAvailable(reading) {
         return false;
     }
 }
+export function allowRulesGate(reading, settingsRead) {
+    if (!permissionsAllowGrantAvailable(reading))
+        return 'capability_off';
+    return settingsRead === 'clean' ? 'open' : 'settings_read_not_clean';
+}
 function ownReadingField(reading, key) {
     try {
         if (reading === null || typeof reading !== 'object' || Array.isArray(reading))
@@ -54,10 +59,14 @@ function ownReadingField(reading, key) {
         return undefined;
     }
 }
-export function permissionsAllowGrantDoctorDetail(reading) {
-    if (permissionsAllowGrantAvailable(reading)) {
+export function permissionsAllowGrantDoctorDetail(reading, settingsRead) {
+    const gate = allowRulesGate(reading, settingsRead);
+    if (gate === 'open') {
         return 'allow rules sent to the engine — it reads them as rules, not as an exclusive list: a matching call counts as answered for, and the engine still raises its own prompts where it requires them';
     }
+    if (gate === 'settings_read_not_clean') {
+        return 'allow rules from settings files kept on this side — this engine reads allow rules as rules, but the settings read that produced them was not reported clean (a settings file was unreadable or had a problem, or no read health was given), so they are not sent; command-line and session allow rules are still sent, and matching approvals are still answered here';
+    }
     const kind = ownReadingField(reading, 'kind');
     if (kind === 'present' && ownReadingField(reading, 'grants') === false) {
         return 'allow rules kept on this side — this engine says it does not read allow rules as rules of that kind, so they are not sent and matching approvals are still answered here';

package/dist/permissionsDeclaration.d.ts

@@ -12,6 +12,7 @@ export interface PermissionsDeclarationInput {
     readonly allow: readonly string[];
     readonly origins?: WireRuleOrigins;
     readonly cliDeny?: readonly string[];
+    readonly settingsRead: 'clean' | 'partial' | 'unreadable';
 }
 export interface PermissionsDeclarationBuckets {
     deny?: string[];
@@ -21,5 +22,33 @@ export interface PermissionsDeclarationBuckets {
 export interface PermissionsDeclaration {
     permissions?: PermissionsDeclarationBuckets;
 }
+export declare const PERMISSIONS_KEPT_REASONS: readonly ["allow_capability_off", "settings_read_not_clean", "empty_rule", "paren_in_tool_name", "retired_tool_name", "unprefixed_namespaced_name", "incomplete_protocol_name", "unminted_protocol_segment", "home_relative_path", "compile_refused", "content_form_not_grantable", "judge_failed", "duplicate"];
+export type PermissionsKeptReason = (typeof PERMISSIONS_KEPT_REASONS)[number];
+export interface PermissionsKeptRule {
+    rule: string;
+    bucket: 'deny' | 'ask' | 'allow';
+    reason: PermissionsKeptReason;
+}
+export interface PermissionsRewrittenRule {
+    from: string;
+    to: string;
+    bucket: 'deny' | 'ask' | 'allow';
+}
+export interface PermissionsUncheckedRule {
+    rule: string;
+    bucket: 'deny' | 'ask';
+}
+export interface PermissionsUnreachableRule {
+    rule: string;
+    bucket: 'deny' | 'ask';
+    mintedPrefix?: string;
+}
+export interface PermissionsDeclarationReport extends PermissionsDeclaration {
+    kept: PermissionsKeptRule[];
+    rewritten: PermissionsRewrittenRule[];
+    unchecked: PermissionsUncheckedRule[];
+    unreachable: PermissionsUnreachableRule[];
+}
 export declare function permissionsDeclaration(input: PermissionsDeclarationInput, caps: PermissionsAllowGrantReading): PermissionsDeclaration;
+export declare function permissionsDeclarationReport(input: PermissionsDeclarationInput, caps: PermissionsAllowGrantReading): PermissionsDeclarationReport;
 export {};

package/dist/permissionsDeclaration.js

@@ -1,5 +1,7 @@
-import { hasCoreValuePort, protocolOf, retiredToolNames, ruleToolGrammarOf, validatePermissionRules } from './coreValuePorts.js';
-import { permissionsAllowGrantAvailable } from './permissionsAllowGrantCapability.js';
+import { hasCoreValuePort, protocolOf, retiredToolNames, ruleToolGrammarOf } from './coreValuePorts.js';
+import { protocolSegmentOf } from './protocolSegment.js';
+import { ruleCompileVerdict } from './ruleCompileVerdict.js';
+import { allowRulesGate } from './permissionsAllowGrantCapability.js';
 const RULE_TRUST_ORDER = [
     'policySettings',
     'cliArg',
@@ -9,6 +11,21 @@ const RULE_TRUST_ORDER = [
     'localSettings',
     'projectSettings',
 ];
+export const PERMISSIONS_KEPT_REASONS = Object.freeze([
+    'allow_capability_off',
+    'settings_read_not_clean',
+    'empty_rule',
+    'paren_in_tool_name',
+    'retired_tool_name',
+    'unprefixed_namespaced_name',
+    'incomplete_protocol_name',
+    'unminted_protocol_segment',
+    'home_relative_path',
+    'compile_refused',
+    'content_form_not_grantable',
+    'judge_failed',
+    'duplicate',
+]);
 function normalizeLegacyToolName(name) {
     switch (name) {
         case 'Task':
@@ -61,15 +78,15 @@ function requireRulePorts() {
     throw new Error(`permissionsDeclaration: 规则判据端口缺席(${missing.join(' / ')})—— 先用 installCoreValuePorts 装上 core 的同名实现。` +
         '缺席不等于全部合格:不判就发会让整份请求被引擎拒收,不判就删会静默丢掉 deny 规则,所以这里拒绝装配。');
 }
-function engineWireSafe(name) {
+function wireIssue(name) {
     if (name.includes('('))
-        return false;
+        return 'paren_in_tool_name';
     if (retiredToolNames().has(name))
-        return false;
+        return 'retired_tool_name';
     const ns = protocolOf(name);
     if (ns === undefined)
-        return !name.includes('__');
-    return ns.parse(name) !== undefined;
+        return name.includes('__') ? 'unprefixed_namespaced_name' : undefined;
+    return ns.parse(name) !== undefined ? undefined : 'incomplete_protocol_name';
 }
 function wholeServerRuleName(name) {
     const read = name.trim();
@@ -79,24 +96,19 @@ function wholeServerRuleName(name) {
     const peer = read.slice(ns.prefix.length);
     return peer !== '' && !peer.includes('__') && !peer.endsWith('_') ? `${read}__*` : name;
 }
-const RULE_ROOT = '/';
-function compileVerdict(rule, behavior) {
-    try {
-        const issues = validatePermissionRules([{ rule, behavior }], { pathBases: { root: RULE_ROOT } });
-        if (!Array.isArray(issues))
-            return 'unknown';
-        return issues.length === 0 ? 'compiles' : 'refused';
-    }
-    catch {
-        return 'unknown';
-    }
+const compileVerdict = ruleCompileVerdict;
+const kept = (reason) => ({ sent: false, reason });
+function sentFate(wire, toolName, unchecked) {
+    const segment = protocolSegmentOf(toolName);
+    return segment.kind === 'unminted'
+        ? { sent: true, wire, unchecked, unreachable: segment.minted !== undefined ? { minted: segment.minted } : {} }
+        : { sent: true, wire, unchecked };
 }
-function wireSubset(rules, behavior) {
-    const out = new Set();
+function judgeList(rules, behavior) {
     let portsChecked = false;
-    for (const rule of rules) {
-        if (typeof rule !== 'string' || rule === '')
-            continue;
+    return rules.map((rule) => {
+        if (rule === '')
+            return kept('empty_rule');
         if (!portsChecked) {
             requireRulePorts();
             portsChecked = true;
@@ -104,50 +116,85 @@ function wireSubset(rules, behavior) {
         const parsed = parseRule(rule);
         if (parsed.ruleContent === undefined) {
             const name = wholeServerRuleName(parsed.toolName);
-            if (!engineWireSafe(name))
-                continue;
-            if (out.has(name))
-                continue;
-            const verdict = compileVerdict(name, behavior);
-            if (verdict === 'refused' || (verdict === 'unknown' && behavior === 'allow'))
-                continue;
-            out.add(name);
-            continue;
+            const issue = wireIssue(name);
+            if (issue !== undefined)
+                return kept(issue);
+            if (behavior === 'allow') {
+                const segment = protocolSegmentOf(name);
+                if (segment.kind === 'unminted')
+                    return kept('unminted_protocol_segment');
+                if (segment.kind === 'unknown')
+                    return kept('judge_failed');
+            }
+            const verdict = compileVerdict(name, behavior === 'ask' ? 'ask' : 'deny');
+            if (verdict === 'refused')
+                return kept('compile_refused');
+            if (verdict === 'unknown' && behavior === 'allow')
+                return kept('judge_failed');
+            return behavior === 'allow' ? { sent: true, wire: name, unchecked: false } : sentFate(name, name, verdict === 'unknown');
         }
-        if (!engineWireSafe(parsed.toolName))
-            continue;
+        const issue = wireIssue(parsed.toolName);
+        if (issue !== undefined)
+            return kept(issue);
         if (ruleToolGrammarOf(parsed.toolName) === 'path' && parsed.ruleContent.startsWith('~/'))
-            continue;
+            return kept('home_relative_path');
+        if (behavior === 'allow')
+            return kept('content_form_not_grantable');
         const verdict = compileVerdict(rule, behavior);
-        if (verdict === 'compiles' || (verdict === 'unknown' && behavior !== 'allow'))
-            out.add(rule);
-    }
-    return [...out];
+        if (verdict === 'refused')
+            return kept('compile_refused');
+        return sentFate(rule, parsed.toolName, verdict === 'unknown');
+    });
+}
+function outsideSettingsFiles(origin) {
+    return origin === 'cliArg' || origin === 'session';
 }
-function projectBucketByTrust(raw, behavior, originOf, cliRules) {
-    const present = new Set(raw);
+function judgeBucket(raw, behavior, originOf, cli, settingsGate) {
+    const firstSlot = new Map();
+    for (const s of raw)
+        if (!firstSlot.has(s.rule))
+            firstSlot.set(s.rule, s);
     const groups = RULE_TRUST_ORDER.map(() => []);
     const rankOf = (origin) => RULE_TRUST_ORDER.indexOf(origin);
     if (originOf !== undefined) {
         for (const [r, origin] of originOf) {
             const rank = rankOf(origin);
-            if (rank >= 0 && typeof r === 'string' && present.has(r))
+            if (rank >= 0 && typeof r === 'string' && firstSlot.has(r))
                 groups[rank].push(r);
         }
     }
-    const unknownOrigin = [...present].filter((r) => originOf === undefined || rankOf(originOf.get(r)) < 0);
-    const out = new Set();
-    const append = (list) => {
-        for (const r of list)
-            out.add(r);
+    const unknownOrigin = [...firstSlot.keys()].filter((r) => originOf === undefined || rankOf(originOf.get(r)) < 0);
+    const fateOfRule = new Map();
+    const sent = [];
+    const winnerOf = new Map();
+    const cliFates = cli === undefined ? [] : [...cli.fates];
+    const place = (slot, fate) => {
+        if (!fate.sent)
+            return fate;
+        if (winnerOf.has(fate.wire))
+            return kept('duplicate');
+        winnerOf.set(fate.wire, slot);
+        sent.push(fate.wire);
+        return fate;
+    };
+    const appendGroup = (group, origin) => {
+        const held = settingsGate !== undefined && !outsideSettingsFiles(origin);
+        const fates = held ? group.map(() => kept(settingsGate)) : judgeList(group, behavior);
+        group.forEach((r, k) => fateOfRule.set(r, place(firstSlot.get(r), fates[k])));
     };
     RULE_TRUST_ORDER.forEach((origin, rank) => {
-        if (origin === 'cliArg')
-            append(cliRules);
-        append(wireSubset(groups[rank], behavior));
+        if (origin === 'cliArg' && cli !== undefined)
+            cli.slots.forEach((s, k) => (cliFates[k] = place(s, cliFates[k])));
+        appendGroup(groups[rank], origin);
+    });
+    appendGroup(unknownOrigin, undefined);
+    const fates = raw.map((s) => {
+        const f = fateOfRule.get(s.rule);
+        if (firstSlot.get(s.rule) === s)
+            return f;
+        return f.sent || f.reason === 'duplicate' ? kept('duplicate') : f;
     });
-    append(wireSubset(unknownOrigin, behavior));
-    return [...out];
+    return { sent, fates: [...fates, ...cliFates], winnerOf };
 }
 const WHO = 'permissionsDeclaration';
 function ownField(obj, key, where) {
@@ -192,7 +239,8 @@ function originMap(v, key) {
     }
     return snap;
 }
-export function permissionsDeclaration(input, caps) {
+const slotsOf = (list, name) => (list ?? []).map((rule, at) => ({ rule, list: name, at }));
+function assemble(input, caps) {
     if (input === null || typeof input !== 'object' || Array.isArray(input)) {
         throw new TypeError(`${WHO}: 入参必须是对象 —— 收到 ${input === null ? 'null' : Array.isArray(input) ? 'array' : `typeof=${typeof input}`}。`);
     }
@@ -211,17 +259,58 @@ export function permissionsDeclaration(input, caps) {
         const ol = originMap(ownField(originsRaw, 'allow', 'origins.'), 'allow');
         origins = { ...(od ? { deny: od } : {}), ...(oa ? { ask: oa } : {}), ...(ol ? { allow: ol } : {}) };
     }
-    const allowOn = permissionsAllowGrantAvailable(caps);
-    const cliDenyWire = cliDeny === undefined ? [] : wireSubset(cliDeny, 'deny');
-    const denyOut = projectBucketByTrust(deny ?? [], 'deny', origins.deny, cliDenyWire);
-    const askOut = projectBucketByTrust(ask ?? [], 'ask', origins.ask, []);
-    const allowOut = allowOn && allow !== undefined ? projectBucketByTrust(allow, 'allow', origins.allow, []) : [];
-    const permissions = {};
-    if (denyOut.length > 0)
-        permissions.deny = denyOut;
-    if (askOut.length > 0)
-        permissions.ask = askOut;
-    if (allowOut.length > 0)
-        permissions.allow = allowOut;
-    return Object.keys(permissions).length > 0 ? { permissions } : {};
+    const gate = allowRulesGate(caps, ownField(input, 'settingsRead', ''));
+    const cliSlots = slotsOf(cliDeny, 'cliDeny');
+    const cli = cliDeny === undefined ? undefined : { slots: cliSlots, fates: judgeList(cliDeny, 'deny') };
+    const denySlots = slotsOf(deny, 'deny');
+    const askSlots = slotsOf(ask, 'ask');
+    const allowSlots = slotsOf(allow, 'allow');
+    const denyJ = judgeBucket(denySlots, 'deny', origins.deny, cli);
+    const askJ = judgeBucket(askSlots, 'ask', origins.ask, undefined);
+    const allowJ = gate === 'capability_off'
+        ? { sent: [], fates: allowSlots.map(() => kept('allow_capability_off')), winnerOf: new Map() }
+        : judgeBucket(allowSlots, 'allow', origins.allow, undefined, gate === 'settings_read_not_clean' ? 'settings_read_not_clean' : undefined);
+    const buckets = {};
+    if (denyJ.sent.length > 0)
+        buckets.deny = [...denyJ.sent];
+    if (askJ.sent.length > 0)
+        buckets.ask = [...askJ.sent];
+    if (allowJ.sent.length > 0)
+        buckets.allow = [...allowJ.sent];
+    const keptRows = [];
+    const rewritten = [];
+    const unchecked = [];
+    const unreachable = [];
+    const rows = [
+        ['deny', [...denySlots, ...cliSlots], denyJ],
+        ['ask', askSlots, askJ],
+        ['allow', allowSlots, allowJ],
+    ];
+    for (const [bucket, slots, j] of rows) {
+        slots.forEach((s, k) => {
+            const f = j.fates[k];
+            if (!f.sent)
+                keptRows.push({ rule: s.rule, bucket, reason: f.reason });
+        });
+        for (const wire of j.sent) {
+            const winner = j.winnerOf.get(wire);
+            if (winner.rule !== wire)
+                rewritten.push({ from: winner.rule, to: wire, bucket });
+            const f = (winner.list === 'cliDeny' ? j.fates[denySlots.length + winner.at] : j.fates[winner.at]);
+            if (f.sent && f.unchecked && bucket !== 'allow')
+                unchecked.push({ rule: wire, bucket });
+            if (f.sent && f.unreachable !== undefined && bucket !== 'allow') {
+                unreachable.push({ rule: wire, bucket, ...(f.unreachable.minted !== undefined ? { mintedPrefix: f.unreachable.minted } : {}) });
+            }
+        }
+    }
+    return { buckets, report: { kept: keptRows, rewritten, unchecked, unreachable } };
+}
+export function permissionsDeclaration(input, caps) {
+    const { buckets } = assemble(input, caps);
+    return Object.keys(buckets).length > 0 ? { permissions: buckets } : {};
+}
+export function permissionsDeclarationReport(input, caps) {
+    const { buckets, report } = assemble(input, caps);
+    return { ...(Object.keys(buckets).length > 0 ? { permissions: buckets } : {}), ...report };
 }

package/dist/pluginHooksWire.js

@@ -1,15 +1,6 @@
 import { displayUntrusted } from './displayUntrusted.js';
-export const ENGINE_FIRED_HOOK_EVENTS = [
-    'PreToolUse',
-    'PostToolUse',
-    'PostToolUseFailure',
-    'PostToolBatch',
-    'PreCompact',
-    'PostCompact',
-    'Stop',
-    'StopFailure',
-    'UserPromptSubmit',
-];
+import { SETTINGS_ENGINE_OWNED_HOOK_EVENTS } from './generated/settingsSchemaTables.js';
+export const ENGINE_FIRED_HOOK_EVENTS = SETTINGS_ENGINE_OWNED_HOOK_EVENTS;
 export const PLUGIN_HOOK_DISPOSITIONS = ['engine', 'shell', 'not_run'];
 export const PLUGIN_HOOK_REASONS = [
     'projected',