@sema-agent/core 5.56.0 → 5.58.0

package/dist/core/permission-rule-model.js

@@ -20,26 +20,12 @@ export const SHELL_RESERVED_WORDS = new Set([
     "function", "if", "in", "select", "then", "time", "until", "while",
 ]);
 export const SUGGESTION_LEXICON = [
-    "git status", "git log", "git diff", "git show", "git branch", "git checkout", "git switch",
-    "git add", "git commit", "git push", "git pull", "git fetch", "git merge", "git rebase",
-    "git tag", "git blame", "git describe", "git cherry-pick", "git restore", "git reset",
-    "git rev-parse", "git ls-files", "git grep",
     "git stash list", "git stash show", "git stash push", "git stash pop", "git stash drop",
     "git remote show", "git worktree list", "git submodule update", "git submodule status",
-    "npm run", "npm test", "npm ci", "npm ls", "npm view", "npm outdated", "npm audit",
-    "npm pack", "npm publish", "npm version", "npm why",
-    "pnpm run", "pnpm test", "pnpm ls", "pnpm outdated", "pnpm audit", "pnpm why",
-    "yarn run", "yarn test", "yarn workspaces list",
-    "cargo build", "cargo test", "cargo run", "cargo check", "cargo clippy", "cargo fmt",
-    "cargo doc", "cargo tree", "cargo bench", "cargo update", "cargo metadata",
-    "go build", "go test", "go vet", "go fmt", "go doc",
+    "yarn workspaces list",
     "go mod tidy", "go mod download", "go mod verify", "go mod graph",
-    "docker ps", "docker images", "docker logs", "docker inspect", "docker build", "docker pull",
-    "docker push", "docker stop", "docker start", "docker restart", "docker rm", "docker rmi",
     "docker compose up", "docker compose down", "docker compose ps", "docker compose logs",
     "docker compose build", "docker compose pull",
-    "kubectl get", "kubectl describe", "kubectl logs", "kubectl apply", "kubectl delete",
-    "kubectl diff", "kubectl explain", "kubectl top",
     "kubectl rollout status", "kubectl rollout restart", "kubectl rollout history",
     "gh pr view", "gh pr list", "gh pr diff", "gh pr checks", "gh pr status", "gh pr create",
     "gh pr merge", "gh issue view", "gh issue list", "gh issue create", "gh repo view",
@@ -48,6 +34,31 @@ export const SUGGESTION_LEXICON = [
     "gh search repos", "gh search issues", "gh search prs", "gh search code",
 ];
 const LEXICON_BODIES = SUGGESTION_LEXICON.map((b) => b.split(" "));
+const GENERIC_SUBCOMMAND_WORD = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
+const SCREENED_HEAD_NAMES = new Set([...BARE_INTERPRETER_NAMES].map((n) => n.toLowerCase()));
+const TRAILING_DOTS = /\.+$/;
+const EXECUTABLE_SUFFIX = /\.(?:exe|com|bat|cmd)$/;
+const PROPOSABLE_HEAD_NAME = /^[A-Za-z0-9._+-]+$/;
+function screenedHeadName(head) {
+    let name = commandBasename(head).toLowerCase();
+    for (;;) {
+        const peeled = name.replace(TRAILING_DOTS, "").replace(EXECUTABLE_SUFFIX, "");
+        if (peeled === name || peeled === "")
+            return name;
+        name = peeled;
+    }
+}
+function genericPrefixBody(tokens) {
+    const head = tokens[0];
+    const second = tokens[1];
+    if (head === undefined || second === undefined)
+        return undefined;
+    if (!PROPOSABLE_HEAD_NAME.test(commandBasename(head)))
+        return undefined;
+    if (SCREENED_HEAD_NAMES.has(screenedHeadName(head)))
+        return undefined;
+    return GENERIC_SUBCOMMAND_WORD.test(second) ? `${head} ${second}` : undefined;
+}
 function longestReviewedBody(tokens) {
     let best;
     for (const words of LEXICON_BODIES) {
@@ -151,6 +162,9 @@ export function escapeForDisclosure(value) {
     });
     return escaped.length <= DISCLOSED_RULE_TEXT_MAX_CHARS ? escaped : `${escaped.slice(0, DISCLOSED_RULE_TEXT_MAX_CHARS)}…`;
 }
+export function hasUnrenderableCharacters(text) {
+    return CONTROL_CHARS_RE.test(text);
+}
 export function parseAllowRuleText(text, opts) {
     if (text.length > MAX_RULE_TEXT_CHARS) {
         return reject("invalid.too_long", `rule text exceeds ${MAX_RULE_TEXT_CHARS} characters`);
@@ -178,12 +192,11 @@ export function parseAllowRuleText(text, opts) {
             ? reject("invalid.empty_command", `rule "${text}" names no command`)
             : reject("invalid.not_simple_command", `rule "${text}" is not a command this lane can name (${shape.reject})`);
     }
-    if (match === "prefix" && shape.segments.length > 1) {
-        return reject("invalid.not_simple_command", `prefix rule "${text}" names more than one command — a prefix admits anything appended to its body, so only the exact form may name a connector chain`);
-    }
-    const head = commandBasename(shape.names[0] ?? "");
+    const head = commandBasename(shape.names[shape.names.length - 1] ?? "");
     if (match === "prefix" && BARE_INTERPRETER_NAMES.has(head) && opts?.direction !== "tighten") {
-        return reject("invalid.bare_interpreter_prefix", `prefix rule "${text}" is headed by the interpreter "${head}" — such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`);
+        return reject("invalid.bare_interpreter_prefix", shape.segments.length > 1
+            ? `prefix rule "${text}" leaves its final segment open-ended under the interpreter "${head}" — such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`
+            : `prefix rule "${text}" is headed by the interpreter "${head}" — such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`);
     }
     const command = foldSpacing(body);
     if (command === undefined) {
@@ -209,7 +222,10 @@ function admitsUnder(rule, command, reading) {
         return false;
     if (rule.match === "exact")
         return folded === rule.command;
-    if (shape.segments.length > 1)
+    const bodyShape = ruleLaneShapeOf(rule.command, reading);
+    if ("reject" in bodyShape)
+        return false;
+    if (shape.segments.length !== bodyShape.segments.length)
         return false;
     return folded === rule.command || folded.startsWith(rule.command + " ");
 }
@@ -231,43 +247,118 @@ export function scopeCoversCwd(scope, cwd) {
 export function isRuleLive(rule) {
     return rule.adds.length > 0;
 }
-export function findAdmittingRule(rules, call) {
-    const shape = ruleLaneShapeOf(call.command, MATCH_READING);
-    if ("reject" in shape)
-        return undefined;
+export function eligibleContext(rule, call) {
+    return rule.tool === call.tool && scopeCoversCwd(rule.scope, call.cwd);
+}
+export function eligiblePersisted(rule, call) {
+    return isRuleLive(rule) && eligibleContext(rule, call);
+}
+function firstEligibleAdmittingRule(rules, commandText, call) {
     for (const rule of rules) {
-        if (!isRuleLive(rule))
+        if (!eligiblePersisted(rule, call))
             continue;
-        if (rule.tool !== call.tool)
-            continue;
-        if (!scopeCoversCwd(rule.scope, call.cwd))
-            continue;
-        if (ruleAdmitsCommand(rule, call.command))
+        if (ruleAdmitsCommand(rule, commandText))
             return rule;
     }
     return undefined;
 }
-export function suggestRulesForCommand(command) {
+export function findAdmittingRule(rules, call) {
+    const shape = ruleLaneShapeOf(call.command, MATCH_READING);
+    if ("reject" in shape)
+        return undefined;
+    const whole = firstEligibleAdmittingRule(rules, call.command, call);
+    if (whole !== undefined)
+        return [whole];
+    if (shape.segments.length < 2)
+        return undefined;
+    const covering = [];
+    for (const segment of shape.segments) {
+        const first = firstEligibleAdmittingRule(rules, segment, call);
+        if (first === undefined)
+            return undefined;
+        if (!covering.includes(first))
+            covering.push(first);
+    }
+    return covering;
+}
+export function segmentCoverageOf(command, rules, call) {
+    const folded = foldSpacing(command);
+    if (folded === undefined)
+        return undefined;
+    const shape = ruleLaneShapeOf(folded, MATCH_READING);
+    if ("reject" in shape)
+        return undefined;
+    const proposed = rules.proposed ?? [];
+    return shape.segments.map((segment) => ({
+        segment: segment.trim(),
+        covered: firstEligibleAdmittingRule(rules.persisted, segment, call) !== undefined ||
+            proposed.some((p) => eligibleContext({ tool: p.rule.tool, scope: p.scope }, call) && ruleAdmitsCommand(p.rule, segment)),
+    }));
+}
+export function suggestRulesForCommand(command, ctx) {
     const shape = ruleLaneShapeOf(command, MATCH_READING);
     if ("reject" in shape)
         return [];
     const folded = foldSpacing(command);
     if (folded === undefined)
         return [];
-    const out = [];
+    const offers = [];
     const exact = parseAllowRuleText(formatAllowRuleText(folded, "exact"));
     if ("rule" in exact && exact.rule.match === "exact" && ruleAdmitsCommand(exact.rule, command)) {
-        out.push({ rule: exact.rule.rule, match: "exact", command: exact.rule.command });
+        offers.push({ kind: "single", rule: exact.rule.rule, match: "exact", command: exact.rule.command });
+    }
+    const tokensOf = (s) => s.split(/\s+/).filter((t) => t !== "");
+    const bodyOf = (tokens) => longestReviewedBody(tokens) ?? genericPrefixBody(tokens);
+    if (shape.segments.length === 1) {
+        if (offers.length === 1) {
+            const body = bodyOf(tokensOf(folded));
+            if (body !== undefined) {
+                const parsed = parseAllowRuleText(formatAllowRuleText(body, "prefix"));
+                if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, command)) {
+                    offers.push({ kind: "single", rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command });
+                }
+            }
+        }
+        return offers;
     }
-    if (out.length === 1 && shape.segments.length === 1) {
-        const body = longestReviewedBody(folded.split(" "));
+    const foldedShape = ruleLaneShapeOf(folded, MATCH_READING);
+    if ("reject" in foldedShape || foldedShape.segments.length !== shape.segments.length)
+        return offers;
+    const segments = foldedShape.segments.map((s) => s.trim());
+    const table = ctx?.coverage;
+    const alignedTable = table !== undefined && table.length === segments.length && table.every((row, i) => row.segment === segments[i]) ? table : undefined;
+    const coveredAt = (i) => alignedTable?.[i]?.covered === true;
+    const mintSegmentRule = (segment) => {
+        const body = bodyOf(tokensOf(segment));
         if (body !== undefined) {
-            const text = formatAllowRuleText(body, "prefix");
-            const parsed = parseAllowRuleText(text);
-            if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, command)) {
-                out.push({ rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command });
+            const parsed = parseAllowRuleText(formatAllowRuleText(body, "prefix"));
+            if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, segment)) {
+                return { rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command };
             }
         }
+        const segExact = parseAllowRuleText(formatAllowRuleText(segment, "exact"));
+        if ("rule" in segExact && segExact.rule.match === "exact" && ruleAdmitsCommand(segExact.rule, segment)) {
+            return { rule: segExact.rule.rule, match: "exact", command: segExact.rule.command };
+        }
+        return undefined;
+    };
+    const minted = [];
+    for (let i = 0; i < segments.length; i++) {
+        if (coveredAt(i))
+            continue;
+        const segment = segments[i];
+        const rule = mintSegmentRule(segment);
+        if (rule !== undefined && !minted.some((m) => m.rule === rule.rule))
+            minted.push({ ...rule, segment });
+    }
+    const batchRules = minted.slice(0, 5);
+    if (batchRules.length > 0) {
+        const parsedBatch = batchRules.flatMap((r) => {
+            const p = parseAllowRuleText(r.rule);
+            return "rule" in p ? [p.rule] : [];
+        });
+        const uncoveredSegments = segments.filter((segment, i) => !coveredAt(i) && !parsedBatch.some((p) => ruleAdmitsCommand(p, segment))).length;
+        offers.push({ kind: "batch", rules: batchRules, uncoveredSegments });
     }
-    return out;
+    return offers;
 }

package/dist/core/permission-rules.d.ts

@@ -7,7 +7,7 @@
  * run-loop 介入的「声明式数据→ToolPolicy」工厂(`createCoarseCommandNamePolicy` 同形态先例)。
  * core 不读设置文件、不管 source 层级合并 —— Settings-loader 把各层合并成**单一规则表**后编译
  * **一个** policy(不要按层各编译再组合:combinePolicies 的 fold 里 ask 胜 allow,跨 policy 的
- * 显式 allow 规则会被另一 policy 的 ask 吞掉 —— codex 127 审 B3)。
+ * 显式 allow 规则会被另一 policy 的 ask 吞掉)。
  *
  * 🔴 与 CC 的三处有意差(design/127 r2):
  *  - CC 参数级 generic 道无 allow lane(gnn 只有 deny/ask)—— 我们同样:`allow` + 参数级 content =
@@ -16,7 +16,7 @@
  *    **工厂 validator strict**:降级即 invalid(fail-fast 世界观,写错的规则不能静默变宽)。
  *  - 已知主字段参数规则(如 `Bash(command:…)`)默认 **reject**:通配是 trim 后**整串 lexical**
  *    匹配,不是 shell AST / 前缀 lane —— `Bash(command:git push*)` 匹配不了 `cd /x && git push`,
- *    「以为挡住了」比没挡更危险(codex 127 审 M2)。`primaryFieldGeneric:"allow-lexical"` 显式解锁。
+ *    「以为挡住了」比没挡更危险。`primaryFieldGeneric:"allow-lexical"` 显式解锁。
  */
 import type { NamedToolPolicy } from "./tool-policy.js";
 /** [K-PLATFORM-SWEEP] MINOR#11: Bash's REAL non-primary arg names, accepted as generic param rules
@@ -28,7 +28,7 @@ export interface PermissionRule {
     /** CC 语法:`"Tool"` 或 `"Tool(param:pattern)"`。`Tool()`/`Tool(*)` 归一为裸规则;括号可 `\(`/`\)` 转义。 */
     rule: string;
     behavior: "deny" | "ask" | "allow";
-    /** Provenance(codex 127 审 M7):进 deny/ask 的 message 供审计(e.g. `"policySettings"`)。层级
+    /** Provenance:进 deny/ask 的 message 供审计(e.g. `"policySettings"`)。层级
      *  优先级/tighten-only 语义在 Settings-loader,不在这里。 */
     source?: string;
 }
@@ -40,7 +40,7 @@ export interface ParsedPermissionRule {
 }
 export interface PermissionRuleIssue {
     rule: string;
-    /** `invalid.*` = 语法/语义错;`unsupported.*` = CC 合法但 v1 不支持的 lane(codex 127 审 B5:独立
+    /** `invalid.*` = 语法/语义错;`unsupported.*` = CC 合法但 v1 不支持的 lane(独立
      *  分类,绝不静默 no-op —— `Bash(npm run:*)` 被当 generic 参数规则接受后永不匹配是最危险的失败形态)。 */
     code: "invalid.empty_tool" | "invalid.paren" | "invalid.param_split" | "invalid.allow_param_rule" | "invalid.primary_field" | "invalid.cap_exceeded" | "unsupported.bash_prefix"
     /** design/179 D7: a Bash prefix rule under `bashPrefixLane:"rules-store"` — reported so a migration
@@ -65,20 +65,20 @@ export interface PermissionRuleCaps {
     maxStars: number;
     /** Scalar arg values longer than this are NOT matched textually — the rule **fail-closes** to its
      *  lane (a deny rule targeting an oversized value denies; an ask rule asks). 租户规则 × 模型巨串
-     *  的热路径成本上界(codex 127 审 M6)。 */
+     *  的热路径成本上界。 */
     maxScalarValueChars: number;
 }
 export interface PermissionRulePolicyOptions {
     /** Invalid/unsupported rules: `"throw"`(default — 部署作者写错要立刻知道)aggregates ALL issues
      *  into one error; `"skip"` drops them (pair with {@link validatePermissionRules} for a report, and/or
-     *  supply {@link onIssue}). Exception(codex 实现审 M3):`invalid.cap_exceeded` on the WHOLE rule set
+     *  supply {@link onIssue}). Exception(实现审 M3):`invalid.cap_exceeded` on the WHOLE rule set
      *  (maxRules) throws EVEN under `"skip"` — skipping it would compile an EMPTY table and fail-open. */
     onInvalidRule?: "throw" | "skip";
     /** Called once per dropped rule under `"skip"` (audit surface — silent drops are how a deployment
      *  discovers, months later, that its deny never existed). Default: one aggregated `console.warn`. */
     onIssue?: (issue: PermissionRuleIssue) => void;
     /** What the policy returns when NO rule matches. Default `"allow"` = 本 policy 无意见(组合语义)。
-     *  default-closed 部署用 `"ask"`/`"deny"` —— 必须在这 INSIDE the policy(codex 127 审 B3:链尾
+     *  default-closed 部署用 `"ask"`/`"deny"` —— 必须在这 INSIDE the policy(链尾
      *  ask policy 会在 fold 里吞掉本 policy 的显式 allow)。 */
     defaultAction?: "allow" | "ask" | "deny";
     /** 已知主字段参数规则(`Bash(command:…)` 等)的处置。默认 `"reject"`(整串 lexical ≠ 前缀/AST,
@@ -136,7 +136,7 @@ export declare function namespacedRuleNameCovers(ruleName: string, toolName: str
 export declare function isNamespacedCoveringRuleName(name: string): boolean;
 /** Exported for the lockstep guard only (see {@link FILE_TOOL_PARAMS}) — not part of the rule DSL. */
 export declare const fileToolParamVocabulary: (canonicalTool: string) => ReadonlySet<string> | undefined;
-/** Dry-run 校验/迁移报告(codex 127 审 B5):不 throw,返回全部 issues(含 `unsupported.*` 分类,
+/** Dry-run 校验/迁移报告:不 throw,返回全部 issues(含 `unsupported.*` 分类,
  *  供从 CC settings 迁移的部署逐条对照)。 */
 export declare function validatePermissionRules(rules: PermissionRule[], opts?: Pick<PermissionRulePolicyOptions, "primaryFieldGeneric" | "caps" | "bashPrefixLane">): PermissionRuleIssue[];
 /**
@@ -145,7 +145,7 @@ export declare function validatePermissionRules(rules: PermissionRule[], opts?:
  * bare allow → `defaultAction`. `check()` is idempotent and side-effect-free (combinePolicies 契约);
  * all parsing/validation happens HERE, the hot path never re-parses.
  *
- * ⚠️ Composition note (codex 127 审 B3): an `allow` from this policy is "no objection", NOT a
+ * ⚠️ Composition note: an `allow` from this policy is "no objection", NOT a
  * cross-policy override — another policy's ask/deny still outranks it in the combinePolicies fold.
  * Express default-closed via `defaultAction`, never via a trailing always-ask policy.
  */

package/dist/core/remote-env.d.ts

@@ -52,7 +52,7 @@ export interface WorkspaceHandle {
     snapshotId?: SnapshotId;
     /** Token for {@link RemoteExecutionEnv.reconnect} when the VM is still running (vs suspended to a snapshot). */
     sessionToken?: SessionToken;
-    /** How a checkpointed workspace is restored on resume (1.257.2 hardening, codex review of [500]②):
+    /** How a checkpointed workspace is restored on resume (1.257.2 hardening):
      *  `"park_only"` = durable-park-only suspend degrade (non-suspendable env; workspace persists on the
      *  target, resume skips `resumeVM`). Absent = legacy/snapshot handle — resume treats a MISSING
      *  `snapshotId` as corruption (fail-closed) unless the resumed env is itself non-suspendable
@@ -98,7 +98,7 @@ export interface VmLifecycleOptions {
     /** Abort a hung pause/restore. */
     abortSignal?: AbortSignal;
     /**
-     * [1461]④a (resume workspace-root fidelity) — the CHECKPOINTED {@link WorkspaceHandle} of the workspace
+     * (resume workspace-root fidelity) — the CHECKPOINTED {@link WorkspaceHandle} of the workspace
      * being restored, passed by the engine on the `resumeVM` leg. An adapter SHOULD bind the restored
      * workspace root (cwd / mount) to `priorHandle.mountPath` rather than its CURRENT deployment
      * configuration: across a config-knob change window (e.g. a mount-path rotation) the resumed task's
@@ -289,7 +289,7 @@ export interface RemoteExecutionEnv extends ExecutionEnv {
          *
          *  ⚠️ LOAD-BEARING INVARIANT (opus review 1.257.2): `suspendable:false` on a remote env also asserts
          *  the workspace is EXTERNALLY DURABLE — it persists on the target across the env object's lifetime
-         *  (true for SSH hosts / ADB devices). The durable-park-only suspend degrade (service [500]②) rests
+         *  (true for SSH hosts / ADB devices). The durable-park-only suspend degrade rests
          *  on this: it skips `suspendVM` and trusts the factory to reconnect to the SAME workspace on resume.
          *  An adapter for a non-suspendable EPHEMERAL backend (e.g. a snapshot-less container torn down with
          *  the transport) must NOT be modeled as `suspendable:false` remote — it would silently take the
@@ -359,7 +359,7 @@ export interface RemoteExecutionEnv extends ExecutionEnv {
      * expired while suspended). Any failed step → `Err("post_resume_failed")` and the caller MUST destroy the env.
      *
      * Note: a resumed guest's network/long-lived connections (git remote / API / registry) are NOT guaranteed to
-     * survive the snapshot (clay decision 2), so this is also where the VM-internal agent rebuilds those.
+     * survive the snapshot (decision 2), so this is also where the VM-internal agent rebuilds those.
      *
      * 🔴 Ordering red line (design/48 §5/#6): at-rest encryption of the memory snapshot must be ensured BEFORE
      * secrets are injected — never let plaintext credentials land in an unencrypted snapshot. That encryption is a
@@ -391,10 +391,10 @@ export interface RemoteExecutionEnv extends ExecutionEnv {
      * once on task end, and `prepareTask` calls it on a prepare-time throw; a remote impl may also be reaped,
      * so a defensive double-call must not error or double-bill.
      *
-     * 飞轮 [519] contract note: on a NON-isolated env (no `capabilities.isolation` — host lane, SSH host),
+     * contract note: on a NON-isolated env (no `capabilities.isolation` — host lane, SSH host),
      * destroy() is workspace/object-level cleanup and must NOT reap still-running background processes —
      * that is `disposeBackgroundShells`' job, which honours the timeout/session keep-alive except-list
-     * ([511]③ monitor timeout anchor). An isolated env (container/VM) naturally takes everything down;
+     * (monitor timeout anchor). An isolated env (container/VM) naturally takes everything down;
      * the Runner's envDying settle accounts for that with an accurate killed receipt beforehand.
      */
     destroy(): Promise<void>;
@@ -423,7 +423,7 @@ export interface ExecutionEnvFactoryContext {
      */
     isolation?: "worktree";
     /**
-     * Blackboard 2026-07-03 (clay dogfood — sub-agents landing in an EMPTY sandbox): the PARENT task's
+     * Field-reported (sub-agents landing in an EMPTY sandbox): the PARENT task's
      * effective working root, threaded (like `isolation`) via the TRUSTED `RunInternals` channel when this
      * task is a sub-agent (workflow `ctx.agent` / Task delegation). CC parity: a Task sub-agent inherits the
      * main session's cwd. A single-user/TOC factory SHOULD root the child env here (unless `isolation`
@@ -436,7 +436,7 @@ export interface ExecutionEnvFactoryContext {
 /**
  * A **trusted control-plane** factory that mints a per-task {@link ExecutionEnv} (design/48 §5 answers core
  * gap-a / §7 Q7). Lives on `RunnerDeps` (deployment-level) — NOT on `TaskSpec` — so an untrusted caller can
- * never inject its own env and escape the sandbox (design/44 §7 Q4 red line; clay decision 3: the Docker
+ * never inject its own env and escape the sandbox (design/44 §7 Q4 red line; decision 3: the Docker
  * fast-lane must be control-plane-assigned, never task-selectable).
  *
  * The remote model is "one container per task", so the factory is invoked once per task. The Runner owns the

package/dist/core/roles.d.ts

@@ -24,10 +24,10 @@ export declare const CC_MODEL_TIER_ALIASES: Readonly<Record<string, string>>;
  * - a binding may itself be a catalog name or a Model object (resolved through `resolveModel`);
  *   an unknown binding name throws at construction (config error surfaces at boot, not first use).
  */
-/** [1613] the DISPLAY face of a string model ref: a CC tier ALIAS (haiku/sonnet/…) resolves to its
+/** the DISPLAY face of a string model ref: a CC tier ALIAS (haiku/sonnet/…) resolves to its
  *  sema tier name (lite/flash/…) for labels — the alias verbatim reads as a strong claim about a
  *  specific vendor's model while the actual routing may land anywhere ("haiku" showing over a
- *  DeepSeek run, clay's field report). A non-alias string is the deployment's own model key — its
+ *  DeepSeek run, an operator field report). A non-alias string is the deployment's own model key — its
  *  honest name — and passes through unchanged. Display only; routing (`expandTiers`) is untouched. */
 export declare function resolveModelDisplayLabel(ref: string): string;
 export declare function expandTiers(models: Record<string, Model> | undefined, tiers: Record<string, ModelRef> | undefined): Record<string, Model> | undefined;
@@ -49,7 +49,7 @@ export interface ModelMention {
  */
 export declare function parseModelMention(text: string, allowedNames: Iterable<string>): ModelMention;
 /**
- * Role → 档位默认表(clay 拍 2026-07-11:「role 体系用户不感知」)。配了 `RunnerDeps.tiers` 的部署,
+ * Role → 档位默认表(裁定 2026-07-11:「role 体系用户不感知」)。配了 `RunnerDeps.tiers` 的部署,
  * 各 role 未显式配置时自动落到语义档位——用户/壳只感知档位,roles 降级为内部路由层:
  * - `default` → `pro`(主力档兜底;用户/部署 roles.default / TaskSpec.model 恒可覆盖);
  * - `summarize` → `flash`(压缩本该便宜;flash 未绑沿降档链到 lite);

package/dist/core/roles.js

@@ -102,6 +102,7 @@ const FALLBACK = {
     advisor: ["default"],
     verifier: ["default"],
     classifier: ["summarize", "default"],
+    consolidate: ["summarize"],
 };
 function specParts(s) {
     if (s == null) {

package/dist/core/runner/assemble-result.d.ts

@@ -42,7 +42,7 @@ export interface Stats {
             toolArg?: string;
         }>;
     };
-    /** TB telemetry B2 (service [397]): engine-mechanism engagement counters. Set by the run loop
+    /** TB telemetry B2: engine-mechanism engagement counters. Set by the run loop
      *  only when ≥1 engaged; flows straight through to `TaskResult.stats.mechanisms` via the
      *  public-stats spread. */
     mechanisms?: {
@@ -102,7 +102,7 @@ export interface ResultFlags {
     threw: unknown;
     /** design/99 MF-25: the EFFECTIVE (resolved) model id that served the task — echoed on `TaskResult.model`. */
     model?: string;
-    /** RB-368 ([2076]): some spend was accounted while the serving model had NO configured price table
+    /** RB-368: some spend was accounted while the serving model had NO configured price table
      *  (no `RunnerDeps.pricing` entry, no `Model.cost`). The numeric total is then a fabricated
      *  undercount — `stats.costMicroUsd`/`costBreakdown` are OMITTED from the public result instead of
      *  reporting a 0 indistinguishable from "declared free". The internal accumulator (budget gate's

package/dist/core/runner/compaction-call-options.d.ts

@@ -22,7 +22,7 @@ import type { Prepared } from "./prepare-task.js";
 /**
  * Opt-in working-file attachments (LONGRUN-2 / CC 198 post-compact restore parity).
  *
- * Blackboard 2026-07-03 (CC parity): post-compact file re-read is DEFAULT ON (CC hard-codes it;
+ * CC parity: post-compact file re-read is DEFAULT ON (CC hard-codes it;
  * LONGRUN-2 measured ≈2.3 extra read round-trips per compaction without it). `false` opts out; an
  * object customizes caps. Selection set = most recently READ (CC readFileState semantics) with a
  * modified-files fallback inside maybeCompact. Returns `undefined` when attachments are off or the
@@ -52,7 +52,7 @@ export declare function buildWorkingFileAttachments(spec: TaskSpec, prepared: Pr
  */
 export declare function forkContextOption(prepared: Prepared, disable: boolean): Pick<MaybeCompactOptions, "forkContext">;
 /**
- * RB-31 ([1068]) — compaction-boundary center-candidate adoption. Absent (an empty object, NOT a
+ * RB-31 — compaction-boundary center-candidate adoption. Absent (an empty object, NOT a
  * `centerAdoption: undefined` key) = restate as before; a boundary re-pin hashes the same artifact
  * identity on every lane.
  */
@@ -106,7 +106,7 @@ export declare function projectStaleToolResults(context: Context, cfg: ResolvedS
  *  write-then-discard round-trip per stale result per turn. Caller owns the Set's lifetime. */
 writtenRefs: Set<string>): Promise<Context>;
 /**
- * MF-18 修② ([496]③) — fidelity disclosure: the summary INPUT was clipped to the compaction model's
+ * MF-18 修② — fidelity disclosure: the summary INPUT was clipped to the compaction model's
  * window. Fires pre-call, so the disclosure survives a failed attempt. All three lanes emit the SAME
  * frame; the end-of-task lane passes `spec.tracer ?? deps.tracer` / `spec.taskId ?? sessionId`
  * explicitly because `RunState.telemetry` (which holds exactly those two resolved values) is not in

package/dist/core/runner/memory-consolidation-driver.d.ts

@@ -0,0 +1,49 @@
+/**
+ * design/376 片② — the RUNNER convenience half of the consolidation driver: resolve the model
+ * seat out of a deployment's `RunnerDeps` (explicit chat seat wins; else the `consolidate` role
+ * chain) into the options `runMemoryConsolidationDriver` eats.
+ *
+ * Role resolution lives HERE and not in the engine-layer verb on purpose (design/339 §1.1 + the
+ * d2 ruling): the driver function's own seat is an explicit chat function — models, roles and
+ * tiers are runner vocabulary. The chain is `consolidate → summarize → coded refusal`, and the
+ * refusal is deliberate: one consolidation run reads the whole library (~10⁵ prompt tokens), so
+ * an unset role silently escalating to the most expensive `default` model would be the
+ * bad-value-silence family. A deployment that already declared a cheap `summarize` tier has made
+ * exactly the cost choice this role wants, so that hop stays; pointing `roles.consolidate` at the
+ * main model is a legal explicit choice.
+ */
+import type { Model } from "../../internal/llm.js";
+import type { Brain, ModelRoles, ModelRef, TaskSpec } from "../types.js";
+import { type DistillerChatFn } from "../memory-engine/distiller.js";
+import type { RunMemoryConsolidationOptions } from "../memory-engine/consolidation-driver.js";
+import type { MemoryConsolidationOptions } from "../memory-engine/consolidation.js";
+import type { LlmDistillerContract } from "../memory-engine/distiller.js";
+/** The slice of `RunnerDeps` this resolver reads (pass the deps object itself). */
+export interface MemoryConsolidationDriverDeps {
+    brain: Brain;
+    models?: Record<string, Model>;
+    tiers?: Record<string, ModelRef>;
+    roles?: ModelRoles;
+    memoryConsolidation?: MemoryConsolidationOptions;
+    memoryConsolidationDriver?: {
+        chat?: {
+            baseUrl: string;
+            apiKey: string;
+            model: string;
+        } | DistillerChatFn;
+        model?: string;
+        contract?: LlmDistillerContract;
+        maxCycles?: number;
+        mintRepairBudget?: number;
+    };
+    /** Optional per-model auth hook (the TaskSpec-shaped seat) for the role-resolved path. */
+    getApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
+}
+/**
+ * Resolve a deployment's driver options: `{ chat, model }` from the explicit seat or the role
+ * chain, plus the deployment knobs (contract / maxCycles / mintRepairBudget) and the protocol
+ * parameters (`memoryConsolidation`) threaded through verbatim. The result feeds
+ * `runMemoryConsolidationDriver(engine, scope, resolved)` directly; every bad value refuses
+ * coded here or in the verb's own screen (#123), never folds to a default.
+ */
+export declare function resolveMemoryConsolidationDriver(deps: MemoryConsolidationDriverDeps): RunMemoryConsolidationOptions;

package/dist/core/runner/memory-consolidation-driver.js

@@ -0,0 +1,60 @@
+import { brainToRuntime } from "../runtime.js";
+import { expandTiers, roleModelIfSet } from "../roles.js";
+import { isAliasModelId, openAiCompatChatSeat } from "../memory-engine/distiller.js";
+function seatRefusal(message) {
+    const e = new Error(message);
+    e.code = "config.memory_consolidation_driver";
+    return e;
+}
+export function resolveMemoryConsolidationDriver(deps) {
+    const seat = deps.memoryConsolidationDriver;
+    let chat;
+    let model;
+    if (typeof seat?.chat === "function") {
+        if (typeof seat.model !== "string" || seat.model.trim() === "" || isAliasModelId(seat.model)) {
+            throw seatRefusal(`memoryConsolidationDriver.chat is a bare function, so memoryConsolidationDriver.model must carry the EXPLICIT model id it serves (got ${JSON.stringify(seat.model)}).`);
+        }
+        chat = seat.chat;
+        model = seat.model;
+    }
+    else if (seat?.chat !== undefined) {
+        chat = openAiCompatChatSeat(seat.chat);
+        model = seat.chat.model;
+    }
+    else {
+        const models = expandTiers(deps.models, deps.tiers);
+        const resolved = roleModelIfSet("consolidate", {}, { models, roles: deps.roles }) ?? roleModelIfSet("summarize", {}, { models, roles: deps.roles });
+        if (resolved === undefined) {
+            throw seatRefusal('memory consolidation has no model seat: configure RunnerDeps.memoryConsolidationDriver.chat (an endpoint triple or a chat function), or declare roles.consolidate / roles.summarize (a tier-expanded catalog\'s "flash" binding also satisfies the summarize hop). The chain deliberately does NOT fall back to the default main model — a whole-library distillation must not silently ride the most expensive seat.');
+        }
+        if (isAliasModelId(resolved.id)) {
+            throw seatRefusal(`the resolved consolidation model id ${JSON.stringify(resolved.id)} is an alias spelling — an alias can be re-pointed upstream and would move the run with no trace in the archive; bind an explicit id.`);
+        }
+        model = resolved.id;
+        const runtime = brainToRuntime(deps.brain);
+        chat = async (req) => {
+            const auth = await deps.getApiKeyAndHeaders?.(resolved);
+            const message = await runtime.completeSimple(resolved, { systemPrompt: req.system, messages: [{ role: "user", content: req.user, timestamp: Date.now() }] }, { temperature: req.temperature, maxTokens: req.maxTokens, apiKey: auth?.apiKey, headers: auth?.headers });
+            if (message.stopReason === "error" || message.stopReason === "aborted") {
+                throw new Error(message.errorMessage ?? `model completion ${message.stopReason}`);
+            }
+            return {
+                content: message.content
+                    .filter((c) => c.type === "text")
+                    .map((c) => c.text)
+                    .join(""),
+                finishReason: message.stopReason,
+                usage: { promptTokens: message.usage.input, completionTokens: message.usage.output },
+                model: resolved.id,
+            };
+        };
+    }
+    return {
+        chat,
+        model,
+        ...(seat?.contract !== undefined ? { contract: seat.contract } : {}),
+        ...(seat?.maxCycles !== undefined ? { maxCycles: seat.maxCycles } : {}),
+        ...(seat?.mintRepairBudget !== undefined ? { mintRepairBudget: seat.mintRepairBudget } : {}),
+        ...(deps.memoryConsolidation !== undefined ? { consolidation: deps.memoryConsolidation } : {}),
+    };
+}

package/dist/core/runner/memory-consolidation.d.ts

@@ -27,7 +27,7 @@ export declare const DEFAULT_CONSOLIDATION_MAX_NOTES = 50;
 export declare const DEFAULT_CONSOLIDATION_TIMEOUT_SEC = 30;
 /** Normalize a note body for the EXACT-restatement check in the `<lo` near-dup cheap path. Case- + whitespace-
  *  insensitive ONLY (lower-case, collapse whitespace runs, trim); it PRESERVES every symbol/punctuation so it can
- *  NOT false-equate semantically-distinct facts. (service [365] falsification-style: the earlier `[^\p{L}\p{N}]`-stripping
+ *  NOT false-equate semantically-distinct facts. (falsification-style: the earlier `[^\p{L}\p{N}]`-stripping
  *  normalization made "C#"≡"C", "delta +5"≡"delta -5", "100%"≡"100" — and a textual-CONTAINMENT test on top of it
  *  also mis-judged "rate limit 1000" ⊇ "rate limit 100" (word boundary). A fire-on-every-note, no-LLM path must not
  *  make a semantic-subset call, so the cheap path now folds ONLY an exact restatement; every real near-dup defers

package/dist/core/runner/prepare-config-doors.d.ts

@@ -46,17 +46,17 @@ export declare function limitConfigError(code: string, message: string): Error &
  */
 export declare function resolveTaskLimits(limits: TaskLimits | undefined): TaskLimits | undefined;
 /**
- * R2 双形轴(clay 追加令 2026-07-18): CC 2.1.212's fable-variant prompt gate (b9e —
+ * R2 双形轴(追加令 2026-07-18): CC 2.1.212's fable-variant prompt gate (b9e —
  * `fable_5_mitigations` capability / claude-mythos-5), ORTHOGONAL to the simple/classic profile.
  * sema is BYOM, so the id may carry provider prefixes ("anthropic/claude-fable-5",
  * "openrouter/anthropic/claude-fable-5"): BOUNDARY-AWARE family match on the last path segment
- * (codex 统一复审 F3 — raw substring classified "vendor/not-claude-fable-5" and "claude-mythos-50"
+ * (统一复审 F3 — raw substring classified "vendor/not-claude-fable-5" and "claude-mythos-50"
  * as fable), case-normalized. Recognition set = CC's _Nr (startsWith "claude-fable-") + b9e
  * (mythos-5). R3 system sections fork on the resulting fact.
  */
 export declare function isFableFamilyModelId(id: string): boolean;
 /**
- * RB-50 (CC 2.1.220 启示①, clay 2026-07-25): the SINGLE decision point for the two prompt-shape axes.
+ * RB-50 (CC 2.1.220 启示①, 2026-07-25): the SINGLE decision point for the two prompt-shape axes.
  * Both were resolved in separate places with different mechanisms — `promptProfile` off a TaskSpec field,
  * `fableMitigations` off a raw model-id prefix test — so "which shape does this task speak" had no one
  * place to read. CC 2.1.220's counterpart is a model-registry `capabilities` array (one table drives