@sema-agent/core 7.4.0 → 7.5.1

package/dist/core/mcp.js

@@ -1,3 +1,4 @@
+import { redactSecrets } from "./untrusted-egress.js";
 import { MCP_NAMESPACE } from "./protocol-table.js";
 import { findNamespacePrefixCollision, mintNamespacePrefix, mintNamespacedToolName, normalizeNameSegment } from "./protocol-naming.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -170,8 +171,8 @@ export function mcpIdleTimeoutMs(kind) {
         ? (parseEnvMs("MCP_IDLE_TIMEOUT_STDIO") ?? MCP_IDLE_TIMEOUT_STDIO_DEFAULT_MS)
         : (parseEnvMs("MCP_IDLE_TIMEOUT_HTTP") ?? MCP_IDLE_TIMEOUT_HTTP_DEFAULT_MS);
 }
-function idleKindOf(spec) {
-    return spec.transport.kind === "stdio" ? "stdio" : "http";
+function idleKindOf(kind) {
+    return kind === "stdio" ? "stdio" : "http";
 }
 const IDLE_WATCHDOG_ABORT_REASON = Symbol("mcp-idle-watchdog-abort");
 function armMcpIdleWatchdog(health, idleMs, outerSignal) {
@@ -220,18 +221,22 @@ export function collapseMcpErrorPrefix(message) {
         out = out.slice(m[0].length);
     }
 }
-function collapseMcpErrorStampInPlace(err) {
-    if (!(err instanceof McpError))
+function sanitizeMcpErrorTextInPlace(err) {
+    if (!(err instanceof Error))
         return;
-    const collapsed = collapseMcpErrorPrefix(err.message);
-    if (collapsed !== err.message)
-        err.message = collapsed;
+    const sanitized = redactSecrets(err instanceof McpError ? collapseMcpErrorPrefix(err.message) : err.message);
+    if (sanitized !== err.message)
+        err.message = sanitized;
 }
 function namedMcpFailureText(err) {
-    const detail = err instanceof Error ? collapseMcpErrorPrefix(err.message) : String(err);
+    const detail = remoteErrorText(err, { collapse: true });
     const condition = err instanceof McpError ? describeMcpSpecErrorCode(err.code) : undefined;
     return condition !== undefined ? `${condition}: ${detail}` : detail;
 }
+function remoteErrorText(err, opts) {
+    const raw = err instanceof Error ? err.message : String(err);
+    return redactSecrets(opts?.collapse === true ? collapseMcpErrorPrefix(raw) : raw);
+}
 function isTransportLost(err) {
     if (err instanceof McpError && err.code === ErrorCode.ConnectionClosed)
         return true;
@@ -284,6 +289,38 @@ export function describeHttpTransportFailure(err) {
     }
     return undefined;
 }
+export const MCP_FAILURE_CODES = ["connect_refused", "connection_failed", "network", "not_mcp_response", "spawn_failed", "connection_closed", "timeout", "protocol", "invalid_config", "unknown"];
+export function mcpFailureCodeOf(err, transport) {
+    if (err instanceof McpError) {
+        if (err.code === ErrorCode.ConnectionClosed)
+            return "connection_closed";
+        if (err.code === ErrorCode.RequestTimeout)
+            return "timeout";
+        return "protocol";
+    }
+    const http = describeHttpTransportFailure(err);
+    if (http !== undefined) {
+        if (http.httpStatus !== undefined)
+            return `http_${http.httpStatus}`;
+        if (err instanceof StreamableHTTPError)
+            return "not_mcp_response";
+        const code = networkErrorCode(err);
+        if (code === undefined)
+            return "network";
+        if (code === "ERR_INVALID_URL")
+            return "invalid_config";
+        if (code.startsWith("ERR_"))
+            return "unknown";
+        if (transport === "stdio")
+            return "spawn_failed";
+        if (transport === undefined)
+            return "connection_failed";
+        return http.delivered === "no" ? "connect_refused" : "connection_failed";
+    }
+    if (isTransportLost(err))
+        return "connection_closed";
+    return "unknown";
+}
 function writeEffectWarning(writeEffect) {
     return writeEffect
         ? " This tool is write-capable: treat its side effects as POSSIBLY APPLIED and verify the actual state before retrying."
@@ -301,6 +338,7 @@ function rethrowHonestMcpError(err, ctx) {
         }
         throw e;
     };
+    sanitizeMcpErrorTextInPlace(err);
     if (ctx.idle?.signal.reason === IDLE_WATCHDOG_ABORT_REASON) {
         const serverLabel = inlineUntrusted(ctx.server);
         const e = new Error(`${ctx.what} on MCP server "${serverLabel}" received no response for ${ctx.idle.idleMs}ms (idle watchdog — ` +
@@ -313,7 +351,6 @@ function rethrowHonestMcpError(err, ctx) {
     }
     if (ctx.signal?.aborted)
         finish(err);
-    collapseMcpErrorStampInPlace(err);
     const serverLabel = inlineUntrusted(ctx.server);
     const fenceServerText = (label, raw) => delimitUntrusted(label, truncateMcpErrorText(raw));
     if (err instanceof McpError && err.code === ErrorCode.RequestTimeout) {
@@ -337,7 +374,7 @@ function rethrowHonestMcpError(err, ctx) {
     }
     const httpFailure = describeHttpTransportFailure(err);
     if (httpFailure !== undefined) {
-        const detail = err instanceof Error ? err.message : String(err);
+        const detail = remoteErrorText(err);
         const fenced = `\nThe transport error follows as external/untrusted data:\n${fenceServerText(`${ctx.server} transport error`, detail)}`;
         const e = new Error(httpFailure.delivered === "no"
             ? `${ctx.what} could not reach MCP server "${serverLabel}": ${httpFailure.condition}. The request was not delivered, so the server did not execute it. This server's tools and resources will keep failing until its endpoint is reachable again — do not retry them; use an alternative if one exists.${fenced}`
@@ -360,7 +397,7 @@ function rethrowHonestMcpError(err, ctx) {
         }
     }
     if (ctx.attributeServer) {
-        const msg = err instanceof Error ? err.message : String(err);
+        const msg = remoteErrorText(err);
         finish(new Error(`${ctx.what} on MCP server "${serverLabel}" failed. The server's error text follows as external/untrusted data:\n${fenceServerText(`${ctx.server} error`, msg)}`, { cause: err }));
     }
     finish(err);
@@ -479,15 +516,19 @@ export function resolveProtocolHttpHeaders(protocol, t, principal) {
     }
     return t.headers;
 }
-function buildTransport(spec, principal) {
+function buildTransport(spec, principal, kind) {
     const t = spec.transport;
-    if (t.kind === "stdio") {
+    if (kind === "stdio") {
+        if (!("command" in t))
+            throw new Error(`MCP server "${spec.name}": transport kind "stdio" carries no command`);
         return new StdioClientTransport({
             command: t.command,
             args: t.args,
             env: t.env,
         });
     }
+    if (!("url" in t))
+        throw new Error(`MCP server "${spec.name}": transport kind "${String(kind)}" carries no url`);
     const headers = resolveProtocolHttpHeaders(MCP_NAMESPACE.id, t, principal);
     return new StreamableHTTPClientTransport(new URL(t.url), {
         requestInit: headers ? { headers } : undefined,
@@ -803,7 +844,16 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
     const droppedTools = [];
     let disposing = false;
     const serverHandles = [];
-    const settled = await Promise.allSettled(entries.map((spec) => connectServer(spec, principal, onElicit, imageResizer, mcpDisclosure, isServerRevoked)));
+    const dialKinds = entries.map((spec) => {
+        try {
+            const kind = spec.transport.kind;
+            return kind === "stdio" || kind === "http" ? kind : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    });
+    const settled = await Promise.allSettled(entries.map((spec, i) => connectServer(spec, principal, onElicit, imageResizer, mcpDisclosure, isServerRevoked, dialKinds[i])));
     try {
         for (let i = 0; i < entries.length; i++) {
             const r = settled[i];
@@ -811,7 +861,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
             if (r.status === "fulfilled") {
                 const s = r.value;
                 clients.push(s.client);
-                serverHandles.push({ name: spec.name, spec, client: s.client, health: s.health, tools: s.tools, listedRaw: s.listedTools });
+                serverHandles.push({ name: spec.name, spec, client: s.client, health: s.health, tools: s.tools, listedRaw: s.listedTools, transportKind: dialKinds[i] });
                 tools.push(...s.tools);
                 toolAxes.push(...s.axes);
                 if (s.instructions) {
@@ -843,7 +893,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
             }
             else {
                 warnings.push(asServerWarning(spec, r.reason));
-                statuses.push({ name: spec.name, status: "failed", error: namedMcpFailureText(r.reason) });
+                statuses.push({ name: spec.name, status: "failed", errorCode: mcpFailureCodeOf(r.reason, dialKinds[i]), error: namedMcpFailureText(r.reason) });
             }
         }
         const resourceTools = buildResourceTools(resourceServers, isServerRevoked);
@@ -884,7 +934,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
                     const retainedRaw = listed.incomplete !== undefined ? h.listedRaw.filter((t) => !advertised.has(t.name)) : [];
                     const mergedRaw = retainedRaw.length > 0 ? [...listed.tools, ...retainedRaw] : listed.tools;
                     cacheMcpToolMetadata(h.client, retainedRaw.length > 0 ? [...retainedRaw, ...listed.tools] : listed.tools);
-                    const { serverTools, serverAxes, dropped } = intakeListedTools({ tools: mergedRaw }, h.spec, h.client, h.health, imageResizer, mcpDisclosure, isServerRevoked);
+                    const { serverTools, serverAxes, dropped } = intakeListedTools({ tools: mergedRaw }, h.spec, h.client, h.health, imageResizer, mcpDisclosure, isServerRevoked, h.transportKind);
                     const priorNames = h.tools.map((t) => t.name);
                     const newNames = serverTools.map((t) => t.name);
                     const added = newNames.filter((n) => !priorNames.includes(n));
@@ -1016,7 +1066,7 @@ export async function walkMcpListPages(fetchPage, opts) {
         catch (err) {
             if (pages === 0 || opts.signal?.aborted)
                 throw err;
-            return { items, incomplete: { reason: "page_error", pages, error: err instanceof Error ? err.message : String(err) } };
+            return { items, incomplete: { reason: "page_error", pages, error: remoteErrorText(err) } };
         }
         opts.onPage?.();
         const pageStart = items.length;
@@ -1099,13 +1149,13 @@ async function readDirViaExtension(rs, uri, signal, timeoutMs, watchdog) {
             if (err instanceof McpError && err.code === ErrorCode.InvalidParams) {
                 if (pages > 0)
                     return { kind: "ok", resources, cursorInvalid: true };
-                const detail = collapseMcpErrorPrefix(err.message);
+                const detail = remoteErrorText(err, { collapse: true });
                 return { kind: classifyDirReadInvalidParams(detail), detail };
             }
             if (err instanceof McpError && err.code === ErrorCode.MethodNotFound)
                 return { kind: "unsupported" };
             if (pages > 0 && !signal?.aborted) {
-                return { kind: "ok", resources, incomplete: err instanceof Error ? err.message : String(err) };
+                return { kind: "ok", resources, incomplete: remoteErrorText(err) };
             }
             throw err;
         }
@@ -1212,9 +1262,7 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                             throw err;
                         const msg = watchdog.idleSignal.reason === IDLE_WATCHDOG_ABORT_REASON
                             ? idleWatchdogTripText(idleMs)
-                            : err instanceof Error
-                                ? err.message
-                                : String(err);
+                            : remoteErrorText(err);
                         errors.push({ server: rs.server, error: msg });
                         sections.push(`[${rs.server}] Error: could not list resources: ${inlineUntrusted(msg)}`);
                     }
@@ -1441,7 +1489,7 @@ async function listToolsLenient(client, options) {
     });
     return { tools: walk.items, ...(walk.incomplete !== undefined ? { incomplete: walk.incomplete } : {}) };
 }
-async function connectServer(spec, principal, onElicit, imageResizer, reminderDisclosure, isServerRevoked) {
+async function connectServer(spec, principal, onElicit, imageResizer, reminderDisclosure, isServerRevoked, transportKind) {
     const elicitOn = spec.elicitation === true && onElicit !== undefined;
     const health = { dead: false, pendingElicitations: 0, lastElicitationClosedAt: 0 };
     const client = new Client({ name: `sema-core/${spec.name}`, version: "0.1.0" }, { capabilities: elicitOn ? { elicitation: { form: {} } } : {} });
@@ -1465,7 +1513,7 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
             }
         });
     }
-    const transport = buildTransport(spec, principal);
+    const transport = buildTransport(spec, principal, transportKind);
     const announce = {};
     const startupMs = mcpStartupTimeoutMs();
     const startupOpts = startupMs !== undefined ? { timeout: startupMs } : undefined;
@@ -1477,7 +1525,7 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
         };
         const listed = await listToolsLenient(client, startupOpts);
         cacheMcpToolMetadata(client, listed.tools);
-        const { serverTools, serverAxes, dropped, advisories } = intakeListedTools(listed, spec, client, health, imageResizer, reminderDisclosure, isServerRevoked);
+        const { serverTools, serverAxes, dropped, advisories } = intakeListedTools(listed, spec, client, health, imageResizer, reminderDisclosure, isServerRevoked, transportKind);
         const caps = client.getServerCapabilities();
         const resourceInfo = caps?.resources
             ? {
@@ -1506,7 +1554,7 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
             listedTools: listed.tools,
             ...(instructions ? { instructions } : {}),
             ...(listed.incomplete !== undefined ? { listingIncomplete: listed.incomplete } : {}),
-            ...(resourceInfo && (resourceInfo.listAllowed || resourceInfo.readAllowed) ? { resourceServer: { server: spec.name, client, health, transportKind: idleKindOf(spec), ...resourceInfo } } : {}),
+            ...(resourceInfo && (resourceInfo.listAllowed || resourceInfo.readAllowed) ? { resourceServer: { server: spec.name, client, health, transportKind: idleKindOf(transportKind), ...resourceInfo } } : {}),
         };
     }
     catch (err) {
@@ -1514,7 +1562,7 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
         throw err;
     }
 }
-function intakeListedTools(listed, spec, client, health, imageResizer, reminderDisclosure, isServerRevoked) {
+function intakeListedTools(listed, spec, client, health, imageResizer, reminderDisclosure, isServerRevoked, transportKind) {
     const declaredContentOrigin = spec.contentOrigin;
     const serverTools = [];
     const serverAxes = [];
@@ -1599,7 +1647,7 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
                 if (health.dead)
                     throwDeadServer(spec.name, what);
                 const timeoutMs = mcpToolTimeoutMs();
-                const idleMs = mcpIdleTimeoutMs(idleKindOf(spec));
+                const idleMs = mcpIdleTimeoutMs(idleKindOf(transportKind));
                 const watchdog = armMcpIdleWatchdog(health, idleMs, signal);
                 let res;
                 try {
@@ -1638,7 +1686,7 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
                     const errScLine = structuredContentErrorLine(res.structuredContent, parts.join("\n"));
                     if (errScLine !== undefined)
                         parts.push(errScLine);
-                    const body = truncateMcpErrorText(parts.join("\n").trim());
+                    const body = truncateMcpErrorText(redactSecrets(parts.join("\n").trim()));
                     const msg = body
                         ? `MCP tool ${inlineUntrusted(remoteName)} reported an error. The server's error content follows as external/untrusted data:\n${delimitUntrusted(`${spec.name} tool error`, body)}`
                         : `MCP tool ${inlineUntrusted(remoteName)} reported an error`;
@@ -1687,10 +1735,20 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
     return { serverTools, serverAxes, dropped, advisories };
 }
 function asServerWarning(spec, err) {
-    const warning = new Error(`mcp: server "${spec.name}" failed to connect — skipped (${namedMcpFailureText(err)})`, { cause: err });
+    const warning = new Error(`mcp: server "${spec.name}" failed to connect — skipped (${namedMcpFailureText(err)})`, { cause: sanitizedCause(err) });
     warning.code = "mcp.server_unavailable";
     return warning;
 }
+function sanitizedCause(err) {
+    const copy = new Error(namedMcpFailureText(err));
+    if (err instanceof Error) {
+        copy.name = err.name;
+        const code = err.code;
+        if (typeof code === "string" || typeof code === "number")
+            copy.code = code;
+    }
+    return copy;
+}
 function schemaAdvisoryWarning(server, tool, reason) {
     const warning = new Error(`mcp: server "${inlineUntrusted(server, 160)}" tool "${tool}" is mounted, but ${reason}.`);
     warning.code = "mcp.tool_schema_advisory";

package/dist/core/park-selfcheck.js

@@ -73,6 +73,9 @@ function syntheticCheckpoint(scope) {
             hasBidiControls: true,
             preview: { probe: true, note: "park wiring self-check display stub" },
             previewWithheld: "oversize",
+            requiresRealApproval: true,
+            denialLimitFallback: { consecutive: 3, total: 3, limit: "consecutive", autoDenyAfterMs: 0 },
+            origin: "denial_limit_fallback",
             batchToolCallIds: [`${scope}:call`],
             completedCallIds: [],
         },

package/dist/core/permission-rule-consent.d.ts

@@ -28,8 +28,8 @@
  * defended against: for a file backend, host = user, no more and no less.
  */
 import { type EditedRuleBreadthWarning, type UncoveredSegmentDetail, type RuleOffer, type RuleRejectCode, type RuleScope, type RuleDot } from "./permission-rule-model.js";
-import type { PermissionRuleStoreProvider, RuleOwner } from "./permission-rule-store.js";
-import type { SessionRuleOverlay } from "./permission-rule-session.js";
+import type { RuleOwner } from "./permission-rule-store.js";
+import { type PermissionRuleStoreProvider } from "./permission-rule-provider.js";
 /** One candidate rule inside an approval record: the exact text and where it would apply. */
 export interface RuleCandidate {
     rule: string;
@@ -219,15 +219,6 @@ export interface RuleConsentDeps {
      * happened, and withholding the receipt helps no one.
      */
     cardEdits?: boolean;
-    /**
-     * design/382 §4.3 — the SESSION-RULE OVERLAY: where a `{kind:"session"}` scoped candidate lands at
-     * redemption (the store write leg is never taken for one), and where the prepare-time coverage read
-     * merges a session's standing rows from. Host-provided, session-lifetime, never synced — see
-     * `permission-rule-session.ts` for the contract and the reference implementation. Absent ⇒ a
-     * session-scope candidate's redemption refuses loudly (there is nowhere for it to land), and
-     * coverage reads see no session rows — both fail toward asking.
-     */
-    sessionRules?: SessionRuleOverlay;
     /**
      * design/382 §2.4-6 — the deployment's sensitive-read negative control for the directoryRead MINT
      * floor, same-source with its compiled read-deny judge (`(d) => readDeny.matchPath(d) !== null` is

package/dist/core/permission-rule-consent.js

@@ -1,6 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { escapeForDisclosure, hasUnrenderableCharacters, parseAllowRuleText, ruleAdmitsCommand, ruleBreadthWarningsOf, segmentCoverageOf, suggestRulesForCommand, } from "./permission-rule-model.js";
-import { errText, isValidConsentScope, normalizePersistedRule, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
+import { effectiveOrThrow } from "./permission-rule-provider.js";
+import { errText, isValidConsentScope, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
 export class InMemoryRuleApprovalRecordStore {
     rows = new Map();
     async get(id) {
@@ -296,18 +297,8 @@ export async function prepareCardApproval(opts) {
     })();
     let coverage;
     try {
-        const listed = await storeForOwner(opts.deps.provider, owner).list();
-        let table = listed.rules;
-        const overlay = opts.deps.sessionRules;
-        if (overlay !== undefined && opts.sessionId !== undefined) {
-            const served = structuredClone(await overlay.read(opts.sessionId));
-            const sessionRows = served.filter((r) => {
-                const scope = r?.scope;
-                return scope?.kind === "session" && scope.sessionId === opts.sessionId && !("reject" in normalizePersistedRule(r));
-            });
-            if (sessionRows.length > 0)
-                table = [...sessionRows, ...listed.rules];
-        }
+        const view = await effectiveOrThrow(storeForOwner(opts.deps.provider, owner), opts.sessionId !== undefined ? { sessionId: opts.sessionId } : undefined);
+        const table = view.rules;
         coverage = segmentCoverageOf(opts.command, { persisted: table }, { tool: CARD_RULE_TOOL, cwd: opts.cwd, sessionId: opts.sessionId, ...(opts.execCwd !== undefined ? { execCwd: opts.execCwd } : {}) });
     }
     catch {
@@ -614,45 +605,10 @@ async function applyRedemption(args) {
     if (writer === undefined)
         return { status: "refused", reason: "the resolved permission-rule store has no write face" };
     const origin = originOfRecordKind(args.kind);
-    if (args.candidate.scope.kind === "session") {
-        const overlay = args.deps.sessionRules;
-        if (overlay === undefined) {
-            return {
-                status: "refused",
-                reason: "this deployment wired no session-rule overlay (RuleConsentDeps.sessionRules) — a session-scope authorization has nowhere to land",
-            };
-        }
-        let outcome;
-        try {
-            outcome = await overlay.apply(args.candidate.scope.sessionId, {
-                rule: args.parsedRule.rule,
-                tool: args.parsedRule.tool,
-                match: args.parsedRule.match,
-                command: args.parsedRule.command,
-                add: { dot: args.dot, origin, createdAt: nowIso(args.deps) },
-            });
-        }
-        catch (err) {
-            return { status: "refused", reason: `the session-rule overlay refused the write: ${errText(err)}` };
-        }
-        if ("refused" in outcome) {
-            return {
-                status: "refused",
-                reason: "the session this authorization targets has ended — a session rule dies with its session, and a late or replayed redemption cannot revive it (re-trigger the command in a live session for a fresh card)",
-            };
-        }
-        let rev = 0;
-        try {
-            rev = (await store.list()).rev;
-        }
-        catch {
-        }
-        return { status: "redeemed", rule: args.parsedRule.rule, scope: args.candidate.scope, dot: args.dot, rev, alreadyRedeemed: args.replay };
-    }
     for (let attempt = 0; attempt < REDEEM_MAX_ATTEMPTS; attempt++) {
         let rev;
         try {
-            rev = (await store.list()).rev;
+            rev = (await effectiveOrThrow(store)).rev;
         }
         catch (err) {
             return { status: "refused", reason: `could not read the permission-rule store: ${errText(err)}` };
@@ -676,6 +632,12 @@ async function applyRedemption(args) {
         catch (err) {
             return { status: "refused", reason: `the permission-rule store refused the write: ${errText(err)}` };
         }
+        if ("refused" in res) {
+            return {
+                status: "refused",
+                reason: "the session this authorization targets has ended — a session rule dies with its session, and a late or replayed redemption cannot revive it (re-trigger the command in a live session for a fresh card)",
+            };
+        }
         if (!("conflict" in res)) {
             return { status: "redeemed", rule: args.parsedRule.rule, scope: args.candidate.scope, dot: args.dot, rev: res.rev, alreadyRedeemed: args.replay };
         }
@@ -875,20 +837,9 @@ export async function redeemRuleBatch(opts) {
         const candidate = rec.candidates[candidateIndex];
         const row = { candidateIndex, rule: candidate.rule, scope: candidate.scope };
         let alreadyThere = false;
-        if (candidate.scope.kind === "session") {
-            const sessionScope = candidate.scope;
-            try {
-                const overlayRows = opts.deps.sessionRules === undefined ? [] : await opts.deps.sessionRules.read(sessionScope.sessionId);
-                alreadyThere = overlayRows.some((r) => r.rule === candidate.rule && sameScope(r.scope, sessionScope));
-            }
-            catch (err) {
-                members.push({ ...row, status: "refused", reason: `could not read the session-rule overlay: ${errText(err)}` });
-                continue;
-            }
-        }
-        else {
+        {
             try {
-                const snap = await store.list();
+                const snap = await effectiveOrThrow(store, candidate.scope.kind === "session" ? { sessionId: candidate.scope.sessionId } : undefined);
                 rev = snap.rev;
                 alreadyThere = snap.rules.some((r) => r.rule === candidate.rule && sameScope(r.scope, candidate.scope));
             }