@sema-agent/core 7.0.2 → 7.2.0

package/dist/core/permission-rule-model.js

@@ -1,4 +1,6 @@
+import { homedir } from "node:os";
 import { parsePermissionRule } from "./permission-rules.js";
+import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export const MAX_RULE_TEXT_CHARS = 512;
@@ -193,15 +195,53 @@ export function parseAllowRuleText(text, opts) {
     if (parsed.ruleContent === undefined) {
         return reject("invalid.grammar", `"${text}" is not a Tool(content) rule — a bare tool name claims the whole tool and is not a command rule`);
     }
+    if (parsed.toolName === "Read") {
+        const content = parsed.ruleContent;
+        const m = /^\/\/(.+)\/\*\*$/.exec(content);
+        if (m === null) {
+            return reject("invalid.grammar", `only the Read(//abs-dir/**) directory form is a rule this version reads ("${text}") — relative, single-file, single-slash and no-tail spellings have no rule form`);
+        }
+        const bodyR = m[1];
+        if (bodyR.includes("*")) {
+            return reject("unsupported.wildcard", `a \`*\` inside the directory body matches anything at that position, which has no rule form ("${text}")`);
+        }
+        const segments = bodyR.split("/");
+        if (segments.some((s) => s === "" || s.trim() === "")) {
+            return reject("invalid.grammar", `the directory body of "${text}" is not in the canonical spelling (an empty or whitespace-only path segment) — the lexical normal form is the only accepted spelling`);
+        }
+        if (segments.some((s) => s === "." || s === "..")) {
+            return reject("invalid.path_traversal", `the directory body of "${text}" carries a \`.\` or \`..\` segment — the lexical normal form is the only accepted spelling, and a traversal segment is not normalized away`);
+        }
+        const dir = "/" + bodyR;
+        return { rule: { rule: formatAllowRuleText(dir, "subpath"), tool: "Read", match: "subpath", command: dir } };
+    }
     if (parsed.toolName !== "Bash") {
-        return reject("unsupported.tool", `only Bash rules are supported in this version (got "${parsed.toolName}")`);
+        return reject("unsupported.tool", `only Bash and Read rules are supported in this version (got "${parsed.toolName}")`);
     }
     const content = parsed.ruleContent;
     const prefixBody = /^(.+):\*$/.exec(content)?.[1];
-    const match = prefixBody !== undefined ? "prefix" : "exact";
-    const body = prefixBody ?? content;
-    if (body.includes("*")) {
-        return reject("unsupported.wildcard", `wildcard rule forms are not supported in this version ("${text}")`);
+    let match;
+    let body;
+    if (prefixBody !== undefined) {
+        if (prefixBody.includes("*")) {
+            return reject("unsupported.wildcard", `a \`*\` inside a prefix body matches anything at that position, which has no rule form in this version ("${text}")`);
+        }
+        match = "prefix";
+        body = prefixBody;
+    }
+    else {
+        const wildcardBody = /^(.+) \*$/.exec(content)?.[1];
+        if (wildcardBody !== undefined && !hasUnescapedStar(wildcardBody)) {
+            match = "wildcard";
+            body = wildcardBody;
+        }
+        else if (hasUnescapedStar(content)) {
+            return reject("unsupported.wildcard", `a \`*\` before the end of the pattern matches anything at that position, which has no rule form in this version — only the trailing \`<command> *\` form does ("${text}")`);
+        }
+        else {
+            match = "exact";
+            body = content;
+        }
     }
     const shape = ruleLaneShapeOf(body, MATCH_READING);
     if ("reject" in shape) {
@@ -209,8 +249,11 @@ export function parseAllowRuleText(text, opts) {
             ? reject("invalid.empty_command", `rule "${text}" names no command`)
             : reject("invalid.not_simple_command", `rule "${text}" is not a command this lane can name (${shape.reject})`);
     }
+    if (match === "wildcard" && shape.segments.length > 1) {
+        return reject("unsupported.wildcard", `a \`<chain> *\` pattern names more than one command, and the trailing-star form has no chain reading — the compound-prefix form spells one with the \`:*\` marker ("${text}")`);
+    }
     const head = commandBasename(shape.names[shape.names.length - 1] ?? "");
-    if (match === "prefix" && BARE_INTERPRETER_NAMES.has(head) && opts?.direction !== "tighten") {
+    if ((match === "prefix" || match === "wildcard") && BARE_INTERPRETER_NAMES.has(head) && opts?.direction !== "tighten") {
         return reject("invalid.bare_interpreter_prefix", shape.segments.length > 1
             ? `prefix rule "${text}" leaves its final segment open-ended under the interpreter "${head}" — such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`
             : `prefix rule "${text}" is headed by the interpreter "${head}" — such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`);
@@ -222,7 +265,9 @@ export function parseAllowRuleText(text, opts) {
     return { rule: { rule: formatAllowRuleText(command, match), tool: "Bash", match, command } };
 }
 export function formatAllowRuleText(command, match) {
-    return `Bash(${command}${match === "prefix" ? ":*" : ""})`;
+    if (match === "subpath")
+        return `Read(//${command.startsWith("/") ? command.slice(1) : command}/**)`;
+    return `Bash(${command}${match === "prefix" ? ":*" : match === "wildcard" ? " *" : ""})`;
 }
 function hasUnescapedStar(s) {
     for (let i = 0; i < s.length; i++) {
@@ -236,33 +281,6 @@ function hasUnescapedStar(s) {
     }
     return false;
 }
-function isImportedWildcardContent(content) {
-    return !content.endsWith(":*") && hasUnescapedStar(content);
-}
-export function translateImportedWildcardRule(text) {
-    const parsed = parsePermissionRule(text);
-    const content = parsed.ruleContent;
-    if (content === undefined || parsed.toolName !== "Bash" || !isImportedWildcardContent(content))
-        return undefined;
-    const body = /^(.+) \*$/.exec(content)?.[1];
-    if (body === undefined || body.trim() === "") {
-        return {
-            skip: "unsupported.wildcard: only the trailing `<command> *` form has a prefix-rule equivalent here — it stays in the settings file, unimported",
-        };
-    }
-    if (hasUnescapedStar(body)) {
-        return {
-            skip: "unsupported.wildcard: a `*` before the end of the pattern matches anything at that position, which has no rule form in this version — it stays in the settings file, unimported",
-        };
-    }
-    const bodyShape = ruleLaneShapeOf(body, MATCH_READING);
-    if (!("reject" in bodyShape) && bodyShape.segments.length > 1) {
-        return {
-            skip: "unsupported.wildcard: a `<chain> *` pattern names more than one command, and the trailing-star form has no equivalent for a chain — it stays in the settings file, unimported",
-        };
-    }
-    return { rule: formatAllowRuleText(body, "prefix") };
-}
 export function ruleAdmitsCommand(rule, command) {
     return admitsUnder(rule, command, MATCH_READING);
 }
@@ -270,6 +288,8 @@ export function ruleAdmitsProgramRun(rule, command) {
     return admitsUnder(rule, command, PROGRAM_RUNS_READING);
 }
 function admitsUnder(rule, command, reading) {
+    if (rule.match === "subpath")
+        return false;
     const shape = ruleLaneShapeOf(command, reading);
     if ("reject" in shape)
         return false;
@@ -285,6 +305,30 @@ function admitsUnder(rule, command, reading) {
         return false;
     return folded === rule.command || folded.startsWith(rule.command + " ");
 }
+export function ruleBreadthWarningsOf(rule) {
+    if (rule.match !== "prefix" && rule.match !== "wildcard")
+        return [];
+    const bodyShape = ruleLaneShapeOf(rule.command, MATCH_READING);
+    if ("reject" in bodyShape)
+        return [];
+    if (bodyShape.segments.length > 1) {
+        return [
+            {
+                code: "compound_prefix",
+                message: `this rule's body is a command chain — it admits every run of the whole chain "${rule.command}", with any text extending its final segment`,
+            },
+        ];
+    }
+    if (rule.command.split(/\s+/).filter((t) => t !== "").length === 1) {
+        return [
+            {
+                code: "broad_prefix",
+                message: `this rule admits every argument form of "${rule.command}" — any \`${rule.command} …\` command, not just the one on this card`,
+            },
+        ];
+    }
+    return [];
+}
 export function ruleLaneSegmentsOf(command) {
     const shape = ruleLaneShapeOf(command, PROGRAM_RUNS_READING);
     return "reject" in shape ? undefined : shape.segments;
@@ -295,6 +339,134 @@ export function pathWithinRoot(path, root) {
     const base = root.endsWith("/") ? root : root + "/";
     return path.startsWith(base);
 }
+export function lexicalNormalAbsolutePathOf(path) {
+    if (typeof path !== "string" || !path.startsWith("/"))
+        return undefined;
+    const out = [];
+    for (const seg of path.split("/")) {
+        if (seg === "" || seg === ".")
+            continue;
+        if (seg === "..") {
+            if (out.length === 0)
+                return undefined;
+            out.pop();
+            continue;
+        }
+        out.push(seg);
+    }
+    return out.length === 0 ? "/" : "/" + out.join("/");
+}
+function isLexicalNormalAbsoluteDir(path) {
+    if (typeof path !== "string" || !path.startsWith("/") || path.startsWith("//"))
+        return false;
+    const segments = path.split("/").slice(1);
+    return segments.length > 0 && segments.every((s) => s !== "" && s !== "." && s !== "..");
+}
+export function directoryRuleAdmits(rule, path) {
+    if (rule.tool !== "Read" || rule.match !== "subpath")
+        return false;
+    if (!isLexicalNormalAbsoluteDir(rule.command))
+        return false;
+    if (!isLexicalNormalAbsoluteDir(path))
+        return false;
+    return pathWithinRoot(path, rule.command);
+}
+const CD_TARGET_REJECT_CHARS = /[*?[\]{}$`\\'"<>\n\r]/;
+function cdSegmentDirectoryOf(segment, opts) {
+    if (/[^\S \t]/.test(segment))
+        return undefined;
+    const tokens = segment.split(/[ \t]+/).filter((t) => t !== "");
+    if (tokens.length !== 2 || tokens[0] !== "cd")
+        return undefined;
+    const target = tokens[1];
+    if (CD_TARGET_REJECT_CHARS.test(target))
+        return undefined;
+    if (target.startsWith("-") || target.startsWith("~"))
+        return undefined;
+    let resolved;
+    if (target.startsWith("//"))
+        return undefined;
+    if (target.startsWith("/")) {
+        resolved = target;
+    }
+    else if (target.startsWith("./")) {
+        if (opts.priorCd || opts.cwd === undefined)
+            return undefined;
+        if (!opts.cwd.startsWith("/") || opts.cwd.startsWith("//"))
+            return undefined;
+        resolved = opts.cwd.replace(/\/+$/, "") + target.slice(1);
+    }
+    else {
+        return undefined;
+    }
+    if (!isLexicalNormalAbsoluteDir(resolved))
+        return undefined;
+    if (HOME_TOP_SHAPE.test(resolved))
+        return undefined;
+    if (HOME_ANCESTOR_SHAPE.test(resolved))
+        return undefined;
+    const processHome = userHomeTopLevel();
+    if (processHome !== undefined && (resolved === processHome || isStrictAncestorDir(resolved, processHome))) {
+        return undefined;
+    }
+    return resolved;
+}
+function isStrictAncestorDir(ancestor, path) {
+    return ancestor !== "/" && path.startsWith(`${ancestor}/`);
+}
+const HOME_TOP_SHAPE = /^(?:\/home\/[^/]+|\/Users\/[^/]+|\/root|\/var\/root)$/;
+const HOME_ANCESTOR_SHAPE = /^(?:\/home|\/Users|\/var)$/;
+let HOME_TOP_LEVEL = null;
+function userHomeTopLevel() {
+    if (HOME_TOP_LEVEL === null) {
+        try {
+            const h = homedir();
+            HOME_TOP_LEVEL = typeof h === "string" && h.startsWith("/") && !h.startsWith("//") ? h.replace(/\/+$/, "") : undefined;
+        }
+        catch {
+            HOME_TOP_LEVEL = undefined;
+        }
+    }
+    return HOME_TOP_LEVEL === null ? undefined : HOME_TOP_LEVEL;
+}
+const CURSOR_MOVING_HEADS = new Set(["cd", "pushd", "popd"]);
+const OPAQUE_CURSOR_MOVERS = new Set(["eval", "source", ".", "trap", "enable", "builtin", "command", "time"]);
+function pushdPopdLeavesCursor(head, args) {
+    for (const a of args) {
+        if (a === "--")
+            return false;
+        if (/^-[a-zA-Z]*n[a-zA-Z]*$/.test(a))
+            return true;
+        if (head === "popd" && /^\+0*[1-9]\d*$/.test(a))
+            return true;
+    }
+    return false;
+}
+function movesShellCursor(segment) {
+    if (carriesShellRedirection(segment))
+        return true;
+    const words = segment
+        .split(/[ \t]+/)
+        .map((w) => w.replace(/['"]/g, ""))
+        .filter((t) => t !== "");
+    const head = words[0];
+    if (head === undefined)
+        return false;
+    if (OPAQUE_CURSOR_MOVERS.has(head))
+        return true;
+    if (!CURSOR_MOVING_HEADS.has(head))
+        return false;
+    return !((head === "pushd" || head === "popd") && pushdPopdLeavesCursor(head, words.slice(1)));
+}
+function resolveCdSegmentDirectories(segments, cwd) {
+    let priorCd = false;
+    return segments.map((segment) => {
+        const dir = cdSegmentDirectoryOf(segment, { cwd, priorCd });
+        if (!priorCd && movesShellCursor(segment))
+            priorCd = true;
+        return dir;
+    });
+}
 export function scopeCoversCwd(scope, cwd, sessionId) {
     if (scope.kind === "global")
         return true;
@@ -327,11 +499,16 @@ export function findAdmittingRule(rules, call) {
     const whole = firstEligibleAdmittingRule(rules, call.command, call);
     if (whole !== undefined)
         return [whole];
-    if (shape.segments.length < 2)
-        return undefined;
+    const cdDirs = resolveCdSegmentDirectories(shape.segments, call.execCwd ?? call.cwd);
+    if (shape.segments.length < 2) {
+        const dir = cdDirs[0];
+        const lone = dir !== undefined ? firstEligibleDirectoryRule(rules, dir, call) : undefined;
+        return lone !== undefined ? [lone] : undefined;
+    }
     const covering = [];
-    for (const segment of shape.segments) {
-        const first = firstEligibleAdmittingRule(rules, segment, call);
+    for (const [i, segment] of shape.segments.entries()) {
+        const dir = cdDirs[i];
+        const first = firstEligibleAdmittingRule(rules, segment, call) ?? (dir !== undefined ? firstEligibleDirectoryRule(rules, dir, call) : undefined);
         if (first === undefined)
             return undefined;
         if (!covering.includes(first))
@@ -339,6 +516,15 @@ export function findAdmittingRule(rules, call) {
     }
     return covering;
 }
+function firstEligibleDirectoryRule(rules, directory, call) {
+    for (const rule of rules) {
+        if (!eligiblePersisted(rule, { tool: "Read", cwd: call.cwd, sessionId: call.sessionId }))
+            continue;
+        if (directoryRuleAdmits(rule, directory))
+            return rule;
+    }
+    return undefined;
+}
 export function segmentCoverageOf(command, rules, call) {
     const folded = foldSpacing(command);
     if (folded === undefined)
@@ -347,12 +533,31 @@ export function segmentCoverageOf(command, rules, call) {
     if ("reject" in shape)
         return undefined;
     const proposed = rules.proposed ?? [];
-    return shape.segments.map((segment) => ({
-        segment: segment.trim(),
-        covered: firstEligibleAdmittingRule(rules.persisted, segment, call) !== undefined ||
-            proposed.some((p) => eligibleContext({ tool: p.rule.tool, scope: p.scope }, call) && ruleAdmitsCommand(p.rule, segment)),
-    }));
+    const cdDirs = resolveCdSegmentDirectories(shape.segments, call.execCwd ?? call.cwd);
+    return shape.segments.map((segment, i) => {
+        const dir = cdDirs[i];
+        return {
+            segment: segment.trim(),
+            covered: firstEligibleAdmittingRule(rules.persisted, segment, call) !== undefined ||
+                (dir !== undefined && firstEligibleDirectoryRule(rules.persisted, dir, call) !== undefined) ||
+                proposed.some((p) => p.rule.tool === "Read"
+                    ? dir !== undefined &&
+                        eligibleContext({ tool: p.rule.tool, scope: p.scope }, { tool: "Read", cwd: call.cwd, sessionId: call.sessionId }) &&
+                        directoryRuleAdmits(p.rule, dir)
+                    : eligibleContext({ tool: p.rule.tool, scope: p.scope }, call) && ruleAdmitsCommand(p.rule, segment)),
+        };
+    });
 }
+export const UNCOVERED_SEGMENT_REASON_BASELINE = {
+    redirection: "This part carries a redirection, so it is approved per use — no rule can cover this spelling. If you trust its redirection-free form, a rule can be written for that form (the card's edit row, or settings).",
+    no_rule_form: "No rule form exists for this part; it can be approved per use.",
+    cap_overflow: "This batch does not cover this part; you will be asked again when it comes up.",
+};
+export const RULE_OFFERS_ABSENCE_BASELINE = {
+    mandated: "This approval is required by the deployment's policy each time; a rule cannot waive it.",
+    lane_cannot_speak: "This card has no rule to offer for this exact command; it can be approved per use. A coverable form of what you trust can still get a rule — through a card drawn for that form, or settings.",
+    shadowed: "A rule you already have matches this call and still asks — that standing rule keeps deciding, so a new rule minted here would change nothing; review your existing rules instead.",
+};
 export function suggestRulesForCommand(command, ctx) {
     const shape = ruleLaneShapeOf(command, OFFER_READING);
     if ("reject" in shape)
@@ -367,16 +572,44 @@ export function suggestRulesForCommand(command, ctx) {
     }
     const tokensOf = (s) => s.split(/\s+/).filter((t) => t !== "");
     const bodyOf = (tokens) => longestReviewedBody(tokens) ?? genericPrefixBody(tokens);
+    const directoryGateOpen = (ctx?.scope?.kind === "project" || ctx?.scope?.kind === "session") && scopeCoversCwd(ctx.scope, ctx?.cwd, ctx?.sessionId);
+    const deniesDirectory = ctx?.deniesDirectoryRead ?? defaultDeniesDirectoryRead;
+    const mintDirectoryMember = (directory, segment) => {
+        if (!directoryGateOpen || directory === undefined)
+            return undefined;
+        let denied;
+        try {
+            denied = deniesDirectory(directory) === true;
+        }
+        catch {
+            denied = true;
+        }
+        if (denied)
+            return undefined;
+        const parsed = parseAllowRuleText(formatAllowRuleText(directory, "subpath"));
+        if (!("rule" in parsed) || parsed.rule.match !== "subpath")
+            return undefined;
+        if (!directoryRuleAdmits(parsed.rule, directory))
+            return undefined;
+        return { kind: "directoryRead", rule: parsed.rule.rule, directory: parsed.rule.command, segment };
+    };
     if (shape.segments.length === 1) {
         if (offers.length === 1) {
             const body = bodyOf(tokensOf(folded));
             if (body !== undefined) {
-                const parsed = parseAllowRuleText(formatAllowRuleText(body, "prefix"));
-                if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, command)) {
-                    offers.push({ kind: "single", rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command });
+                const parsed = parseAllowRuleText(formatAllowRuleText(body, "wildcard"));
+                if ("rule" in parsed && parsed.rule.match === "wildcard" && ruleAdmitsCommand(parsed.rule, command)) {
+                    offers.push({ kind: "single", rule: parsed.rule.rule, match: "wildcard", command: parsed.rule.command });
                 }
             }
         }
+        const lone = folded.trim();
+        const loneCovered = ctx?.coverage !== undefined && ctx.coverage.length === 1 && ctx.coverage[0]?.segment === lone && ctx.coverage[0]?.covered === true;
+        if (!loneCovered) {
+            const member = mintDirectoryMember(resolveCdSegmentDirectories([lone], ctx?.execCwd ?? ctx?.cwd)[0], lone);
+            if (member !== undefined)
+                offers.push({ kind: "batch", rules: [member], uncoveredSegments: 0, uncoveredDetail: [] });
+        }
         return offers;
     }
     const foldedShape = ruleLaneShapeOf(folded, OFFER_READING);
@@ -391,9 +624,9 @@ export function suggestRulesForCommand(command, ctx) {
             return undefined;
         const body = bodyOf(tokensOf(segment));
         if (body !== undefined) {
-            const parsed = parseAllowRuleText(formatAllowRuleText(body, "prefix"));
-            if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, segment)) {
-                return { rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command };
+            const parsed = parseAllowRuleText(formatAllowRuleText(body, "wildcard"));
+            if ("rule" in parsed && parsed.rule.match === "wildcard" && ruleAdmitsCommand(parsed.rule, segment)) {
+                return { rule: parsed.rule.rule, match: "wildcard", command: parsed.rule.command };
             }
         }
         const segExact = parseAllowRuleText(formatAllowRuleText(segment, "exact"));
@@ -402,14 +635,19 @@ export function suggestRulesForCommand(command, ctx) {
         }
         return undefined;
     };
+    const cdDirs = resolveCdSegmentDirectories(segments, ctx?.execCwd ?? ctx?.cwd);
     const minted = [];
     for (let i = 0; i < segments.length; i++) {
         if (coveredAt(i))
             continue;
         const segment = segments[i];
-        const rule = mintSegmentRule(segment);
-        if (rule !== undefined && !minted.some((m) => m.rule === rule.rule))
-            minted.push({ ...rule, segment });
+        const dirMember = mintDirectoryMember(cdDirs[i], segment);
+        const member = dirMember ?? (() => {
+            const rule = mintSegmentRule(segment);
+            return rule !== undefined ? { kind: "command", ...rule, segment } : undefined;
+        })();
+        if (member !== undefined && !minted.some((m) => m.rule === member.rule))
+            minted.push(member);
     }
     const batchRules = minted.slice(0, 5);
     if (batchRules.length > 0) {
@@ -417,8 +655,28 @@ export function suggestRulesForCommand(command, ctx) {
             const p = parseAllowRuleText(r.rule);
             return "rule" in p ? [p.rule] : [];
         });
-        const uncoveredSegments = segments.filter((segment, i) => !coveredAt(i) && !parsedBatch.some((p) => ruleAdmitsCommand(p, segment))).length;
-        offers.push({ kind: "batch", rules: batchRules, uncoveredSegments });
+        const uncoveredDetail = [];
+        for (let i = 0; i < segments.length; i++) {
+            const segment = segments[i];
+            if (coveredAt(i))
+                continue;
+            if (parsedBatch.some((p) => p.tool !== "Read" && ruleAdmitsCommand(p, segment)))
+                continue;
+            const dir = cdDirs[i];
+            if (dir !== undefined && parsedBatch.some((p) => directoryRuleAdmits(p, dir)))
+                continue;
+            const reason = carriesShellRedirection(segment) ? "redirection" : mintSegmentRule(segment) === undefined ? "no_rule_form" : "cap_overflow";
+            uncoveredDetail.push({ segment, reason });
+        }
+        offers.push({ kind: "batch", rules: batchRules, uncoveredSegments: uncoveredDetail.length, uncoveredDetail });
     }
     return offers;
 }
+let DEFAULT_DIRECTORY_DENY;
+function defaultDeniesDirectoryRead(directory) {
+    if (DEFAULT_DIRECTORY_DENY === undefined) {
+        const matcher = compileReadDeny([], "directoryRead mint floor");
+        DEFAULT_DIRECTORY_DENY = (d) => matcher.matchPath(d) !== null;
+    }
+    return DEFAULT_DIRECTORY_DENY(directory);
+}

package/dist/core/permission-rule-org.js

@@ -191,8 +191,12 @@ export function unenforceableOrgRules(rules) {
         if (typeof r?.rule !== "string" || r.rule === "")
             continue;
         const parsed = parseAllowRuleText(r.rule, { direction: "tighten" });
-        if ("reject" in parsed)
+        if ("reject" in parsed) {
             out.push({ rule: r.rule, code: parsed.reject.code });
+            continue;
+        }
+        if (parsed.rule.tool !== "Bash")
+            out.push({ rule: r.rule, code: "unsupported.tool" });
     }
     return out;
 }
@@ -259,11 +263,14 @@ export async function effectivePermissionRules(opts) {
     const orgDenies = (opts.orgSnapshot?.rules ?? []).filter((r) => r.behavior === "deny");
     const out = [];
     for (const r of listed.rules) {
-        const segments = ruleLaneSegmentsOf(r.command);
-        const shadowed = orgDenies.some((d) => {
-            const parsed = parseAllowRuleText(d.rule, { direction: "tighten" });
-            return !("reject" in parsed) && parsed.rule.tool === r.tool && orgRuleReaches(parsed.rule, r.command, segments);
-        });
+        const shadowed = r.tool === "Bash" &&
+            (() => {
+                const segments = ruleLaneSegmentsOf(r.command);
+                return orgDenies.some((d) => {
+                    const parsed = parseAllowRuleText(d.rule, { direction: "tighten" });
+                    return !("reject" in parsed) && parsed.rule.tool === r.tool && orgRuleReaches(parsed.rule, r.command, segments);
+                });
+            })();
         out.push({ rule: r.rule, scope: r.scope, status: shadowed ? "shadowed-by-org" : "live" });
     }
     for (const t of listed.tombstones) {

package/dist/core/remote-env.d.ts

@@ -383,8 +383,15 @@ export interface RemoteExecutionEnv extends ExecutionEnv {
      * 🔴 Ordering red line (design/48 §5/#6): at-rest encryption of the memory snapshot must be ensured BEFORE
      * secrets are injected — never let plaintext credentials land in an unencrypted snapshot. That encryption is a
      * service-side property of the snapshot store; this method must fail-and-clean if it cannot be guaranteed.
+     *
+     * `opts.abortSignal` (design/384 slice 2, ADDITIVE — implementations are not forced to change): an
+     * early-release channel for a caller whose wait on this init is bounded (the park fence's paused-VM
+     * compensation). Best-effort exactly like {@link suspendVM}'s — an implementation may ignore it; the
+     * caller bounds its own wait and treats a deaf adapter as failed.
      */
-    postResumeInit(): Promise<{
+    postResumeInit(opts?: {
+        abortSignal?: AbortSignal;
+    }): Promise<{
         ok: true;
         value: void;
     } | {

package/dist/core/roles.d.ts

@@ -9,6 +9,12 @@ export declare function resolveModel(ref: ModelRef, models?: Record<string, Mode
 export declare const DEFAULT_TIER_ORDER: readonly string[];
 /** CC 档位词 → sema 档位(内置固定,兼容层):fable/mythos→max · opus→pro · sonnet→flash · haiku→lite。 */
 export declare const CC_MODEL_TIER_ALIASES: Readonly<Record<string, string>>;
+/** the DISPLAY face of a string model ref: a CC tier ALIAS (haiku/sonnet/…) resolves to its
+ *  sema tier name (lite/flash/…) for labels — the alias verbatim reads as a strong claim about a
+ *  specific vendor's model while the actual routing may land anywhere ("haiku" showing over a
+ *  DeepSeek run, an operator field report). A non-alias string is the deployment's own model key — its
+ *  honest name — and passes through unchanged. Display only; routing (`expandTiers`) is untouched. */
+export declare function resolveModelDisplayLabel(ref: string): string;
 /**
  * Expand a deployment's tier bindings into the model catalog: every tier name (and every CC alias whose
  * tier resolves) becomes a catalog key pointing at the bound Model, so the ENTIRE resolve surface
@@ -29,12 +35,6 @@ export declare const CC_MODEL_TIER_ALIASES: Readonly<Record<string, string>>;
  *   `best` wins); with no bound known-order tier (or no tiers at all) the key stays absent and
  *   `resolveModel("best")` refuses like any unknown ref.
  */
-/** the DISPLAY face of a string model ref: a CC tier ALIAS (haiku/sonnet/…) resolves to its
- *  sema tier name (lite/flash/…) for labels — the alias verbatim reads as a strong claim about a
- *  specific vendor's model while the actual routing may land anywhere ("haiku" showing over a
- *  DeepSeek run, an operator field report). A non-alias string is the deployment's own model key — its
- *  honest name — and passes through unchanged. Display only; routing (`expandTiers`) is untouched. */
-export declare function resolveModelDisplayLabel(ref: string): string;
 export declare function expandTiers(models: Record<string, Model> | undefined, tiers: Record<string, ModelRef> | undefined): Record<string, Model> | undefined;
 export interface ModelMention {
     /** The matched model name — always one of `allowedNames` — or undefined if none was found. */
@@ -49,8 +49,27 @@ export interface ModelMention {
  * pick *which configured model* to use, but can never inject an arbitrary `baseUrl`/`apiKey`/Model
  * (see design/11). Matches the first allow-listed mention; the rest of the text is returned cleaned.
  *
- * Typical use: `const { model, cleanedText } = parseModelMention(userMsg, Object.keys(deps.models));`
+ * **Case-INSENSITIVE, deliberately** — and deliberately UNLIKE the catalog, whose lookups
+ * ({@link resolveModel}) are exact. The two answer different questions and the asymmetry is the
+ * design, not an oversight: a chat mention is a HUMAN-typed UX surface where `@Opus` and `@opus` are
+ * the same intent, so intake is wide; a catalog key is a machine identifier a deployment declared, so
+ * lookup is exact. The join is safe because the wide half never widens the narrow one: this returns
+ * the allowlist's OWN canonical spelling (never the user's casing), so the value handed to
+ * `resolveModel` is always a key the deployment wrote. The only visible consequence is that a catalog
+ * carrying two keys differing ONLY in case is addressed by whichever the allowlist iterates last —
+ * `@x` cannot name both, and there is no spelling that disambiguates them.
+ *
+ * Typical use: `const { model, cleanedText } = parseModelMention(userMsg, Object.keys(runner.agentCatalog.models ?? {}));`
  * then `runTask({ objective: cleanedText, model })` (omit `model` to fall back to the default role).
+ *
+ * **Feed it the EXPANDED table.** The allowlist this takes is the host's own, and on a deployment that
+ * configured `RunnerDeps.tiers` the host's `deps.models` is NOT what the Runner resolves against: the
+ * constructor runs {@link expandTiers} once and keeps the expansion PRIVATE, so tier words and CC
+ * aliases (`pro`/`flash`/`opus`/`sonnet`/`best`/…) are catalog keys inside the Runner and absent from
+ * the host's table. Passing `Object.keys(deps.models)` therefore makes a user's `@opus` silently not
+ * match — the mention falls through as ordinary text and the task quietly runs on the default role.
+ * `runner.agentCatalog.models` is the expanded table (a per-read copy); a caller that has no Runner in
+ * hand can pre-expand its own with the exported {@link expandTiers}.
  */
 export declare function parseModelMention(text: string, allowedNames: Iterable<string>): ModelMention;
 /**
@@ -60,7 +79,10 @@ export declare function parseModelMention(text: string, allowedNames: Iterable<s
  * - `summarize` → `flash`(压缩本该便宜;flash 未绑沿降档链到 lite);
  * - `advisor` → 第一档(`ultra` 起,未绑降档到 max/pro——teacher 用最强的);
  * - `verifier` → `pro`;
- * - `subagent`/`team`/`synthesize` 无档位默认 = 走 FALLBACK 继承主模型(LLM 可经 model 参数自选档)。
+ * - `classifier` → `flash`(design/143 批2b:auto-mode 权限分类腿是便宜档;flash 未绑沿降档链到 lite);
+ * - `subagent`/`team`/`synthesize` 无档位默认 = 走 FALLBACK 继承主模型(LLM 可经 model 参数自选档);
+ * - `consolidate` 同样无档位默认,但它的 FALLBACK 刻意只有 `summarize` 一站(design/376,见
+ *   {@link FALLBACK} 的注):未配即响亮拒,不静默骑主模型。
  * 未配 tiers 的部署:catalog 无 TIERS_ACTIVE 标记 → 表整体 INERT,行为与从前逐字节一致
  * (即使 catalog 恰有裸模型名 `pro`/`flash` 也不入档位路由——INERT 靠配置成立,不靠键名运气)。
  */

package/dist/core/roles.js

@@ -18,7 +18,7 @@ export const CC_MODEL_TIER_ALIASES = {
     haiku: "lite",
 };
 export function resolveModelDisplayLabel(ref) {
-    return CC_MODEL_TIER_ALIASES[ref] ?? ref;
+    return Object.hasOwn(CC_MODEL_TIER_ALIASES, ref) ? CC_MODEL_TIER_ALIASES[ref] : ref;
 }
 const TIERS_ACTIVE = Symbol.for("sema.tiersActive");
 export function expandTiers(models, tiers) {
@@ -27,7 +27,7 @@ export function expandTiers(models, tiers) {
     const out = { ...models };
     out[TIERS_ACTIVE] = true;
     const bound = (name) => {
-        const b = tiers[name];
+        const b = Object.hasOwn(tiers, name) ? tiers[name] : undefined;
         return b === undefined ? undefined : resolveModel(b, models);
     };
     const resolveTier = (name) => {
@@ -44,26 +44,30 @@ export function expandTiers(models, tiers) {
         }
         return undefined;
     };
+    const shadowed = (key) => Object.hasOwn(out, key) && Boolean(out[key]);
+    const put = (key, m) => {
+        Object.defineProperty(out, key, { value: m, writable: true, enumerable: true, configurable: true });
+    };
     const tierNames = new Set([...DEFAULT_TIER_ORDER, ...Object.keys(tiers)]);
     for (const name of tierNames) {
-        if (out[name])
+        if (shadowed(name))
             continue;
         const m = resolveTier(name);
         if (m)
-            out[name] = m;
+            put(name, m);
     }
     for (const [alias, tier] of Object.entries(CC_MODEL_TIER_ALIASES)) {
-        if (out[alias])
+        if (shadowed(alias))
             continue;
         const m = resolveTier(tier);
         if (m)
-            out[alias] = m;
+            put(alias, m);
     }
-    if (!out["best"]) {
+    if (!shadowed("best")) {
         for (const name of DEFAULT_TIER_ORDER) {
             const m = bound(name);
             if (m) {
-                out["best"] = m;
+                put("best", m);
                 break;
             }
         }