@sema-agent/core 7.46.0 → 7.48.0

package/dist/core/permission-rule-model.d.ts

@@ -131,7 +131,9 @@ export declare function readRowBehavior(v: unknown): RuleBehavior | undefined;
  *  clears it. The org/hook/matchedAskRule immunities stay: those conjuncts live in the gate's
  *  persisted-rule lane and do not loosen with this set. */
 export type PersistedRuleTool = string;
-/** The one shell tool the command grammar speaks for. */
+/** The command grammar's ONE rule word — the spelling a shell command rule is written in (`Bash(<command>)`, upstream's).
+ *  A rule word, not a tool list: the calls a command rule reaches are the SHELL FACE's — every catalog definition whose
+ *  `command` the command grammar judges ({@link laneToolNamesOf}). */
 export declare const COMMAND_RULE_TOOL = "Bash";
 /** The one tool whose path family has an ALLOW form (the `Read(//abs-dir/**)` directory grant). */
 export declare const READ_RULE_TOOL = "Read";
@@ -167,8 +169,9 @@ export declare const NAME_RULE_FACES: Readonly<Record<string, {
     readonly params: readonly string[];
 }>>;
 /**
- * Which tools a rule may name — the model's tool set is DERIVED, never a hand-kept list: the shell tool
- * takes the COMMAND grammar; every tool the catalog declares a path target for (Read / Edit / Write /
+ * Which tools a rule may name — the model's tool set is DERIVED, never a hand-kept list: the command rule word
+ * ({@link COMMAND_RULE_TOOL}) takes the COMMAND grammar — the other shell-face tools take none of their own, their command is
+ * judged by the `Bash(…)` rules ({@link laneToolNamesOf}); every tool the catalog declares a path target for (Read / Edit / Write /
  * Glob / NotebookEdit / …, `pathTargetOf`) takes the PATH grammar; the tools of {@link NAME_RULE_FACES} take the NAME grammar.
  * A rule on any other tool has no content this model can judge and is refused (`unsupported.tool`). The tool set therefore
  * moves with the catalog's declarations, exactly as the protective fences' covered set does.
@@ -177,9 +180,12 @@ export declare function ruleToolGrammarOf(toolName: string): "command" | "path"
 /** The value a name-grammar tool's call carries in its name argument — the string every NAME rule is read against, the one a
  *  `Skill` call is resolved by — or undefined (not a name-grammar tool; no such argument; not a string). */
 export declare function nameRuleSubjectOf(toolName: string, args: unknown): string | undefined;
-/** The names the persisted grammar judges a call under: every name the call answers to (the model's spelling, the wire
- *  name, the other aliases that resolve to it) the grammar speaks for, so a stored `Bash(…)` or `Edit(…)` row reaches a
- *  tool that answers to that name under another wire name, as a policy's rule does. Empty ⇒ the grammar speaks for none. */
+/** The rule WORDS a call is judged under, once each: for every name the call answers to (the model's spelling, the wire
+ *  name, the other aliases that resolve to it), the word its rules are written in — a shell-face name's is the command
+ *  grammar's {@link COMMAND_RULE_TOOL} (a `Bash(<command>)` rule reaches `Monitor` as it reaches `Bash`), a path or name
+ *  tool's its own name — so a stored `Bash(…)` or `Edit(…)` row reaches a tool that answers to that name under another wire
+ *  name, as a policy's rule does. Every lane that judges a call by a rule's word reads it here: the policy compiler, the
+ *  person's stored rows, the org partition, the allow lists. Empty ⇒ no grammar speaks for the call. */
 export declare function laneToolNamesOf(req: Pick<import("./tool-policy.js").ToolCallRequest, "toolName" | "face">): readonly string[];
 /**
  * Match forms. Four members, two of them one predicate:

package/dist/core/permission-rule-model.js

@@ -3,7 +3,7 @@ import { parsePermissionRule } from "./permission-rule-syntax.js";
 import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { inlineUntrusted } from "./untrusted-text.js";
-import { pathTargetOf, protectivePathTargetOf } from "./tool-registry.js";
+import { isShellFaceToolName, pathTargetOf, protectivePathTargetOf } from "./tool-registry.js";
 import { heldValues } from "./tool-name-readings.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
 import { bindPathRules, pathRowsReach, rowsWhereTheyLead } from "./path-rule-binding.js";
@@ -26,6 +26,8 @@ export function readRowBehavior(v) {
     return isRuleBehavior(v) ? v : undefined;
 }
 export const COMMAND_RULE_TOOL = "Bash";
+if (!isShellFaceToolName(COMMAND_RULE_TOOL))
+    throw new Error(`permission rules: the command rule word ${JSON.stringify(COMMAND_RULE_TOOL)} names no definition on the catalog's shell face`);
 export const READ_RULE_TOOL = "Read";
 export const PATH_RULE_FACES = Object.freeze({
     [READ_RULE_TOOL]: Object.freeze({ deny: Object.freeze(["read", "write"]), ask: Object.freeze(["read"]) }),
@@ -56,7 +58,13 @@ export function nameRuleSubjectOf(toolName, args) {
     return typeof value === "string" ? value : undefined;
 }
 export function laneToolNamesOf(req) {
-    return heldValues("policy.persistedGrammar", { get: (n) => (ruleToolGrammarOf(n) !== undefined ? n : undefined) }, req);
+    const words = heldValues("policy.persistedGrammar", { get: ruleWordOf }, req);
+    return words.length <= 1 ? words : [...new Set(words)];
+}
+function ruleWordOf(name) {
+    if (isShellFaceToolName(name))
+        return COMMAND_RULE_TOOL;
+    return ruleToolGrammarOf(name) !== undefined ? name : undefined;
 }
 function isCommandMatch(match) {
     return match === "exact" || match === "prefix" || match === "wildcard";

package/dist/core/permission-rules.d.ts

@@ -22,6 +22,10 @@
  * (`programRunReachOf`: the whole command line or any program run in a connector chain — upstream's
  * per-subcommand deny, the same instrument the org partition and the personal store's deny/ask rows use;
  * a call the lexer cannot read against a rule is a fail-closed ask, never silence).
+ * The rule is written in the command word (`Bash`) and reaches every call on the catalog's SHELL FACE — `Bash`, and
+ * `Monitor`, which runs its `command` through the same execution seam — under any name the call answers to; a command
+ * spelling on another shell-face name (`Monitor(touch:*)`) is refused (`invalid.command_rule`, naming the `Bash(…)` form):
+ * upstream reads no such rule. A bare `Bash` rule is a tool-name rule and reaches the tool of that name only.
  * It sits in the field-level tier of the evaluation order — right after the bare deny (resp. ask) — which
  * is upstream's placement (`bs()` whole-tool deny → `AN(…,"deny")` field-level deny → `ph()` whole-tool
  * ask → `AN(…,"ask")` field-level ask).
@@ -57,11 +61,6 @@ import type { NamedToolPolicy } from "./tool-policy.js";
 import { parsePermissionRule, type ParsedPermissionRule } from "./permission-rule-syntax.js";
 import { type PathRuleBases } from "./permission-rule-model.js";
 export { parsePermissionRule, type ParsedPermissionRule };
-/** [K-PLATFORM-SWEEP] MINOR#11: Bash's REAL non-primary arg names, accepted as generic param rules
- *  (`Bash(timeout:...)`). Exported SOLELY so a lockstep test can assert it against the live Bash tool
- *  schema — a schema param added without updating this set would compile to silently-never-matching
- *  rules (the exact drift class the Opus 复审 m note warned about). */
-export declare const BASH_GENERIC_PARAMS: ReadonlySet<string>;
 export interface PermissionRule {
     /** CC 语法:`"Tool"` 或 `"Tool(param:pattern)"`。`Tool()`/`Tool(*)` 归一为裸规则;括号可 `\(`/`\)` 转义。 */
     rule: string;

package/dist/core/permission-rules.js

@@ -1,15 +1,14 @@
 import { MCP_NAMESPACE, protocolOf } from "./protocol-table.js";
 import { splitNamespacedName } from "./tool-name-aliases.js";
-import { catalogRuleFaceOf, pathTargetOf } from "./tool-registry.js";
+import { catalogRuleFaceOf, isShellFaceToolName, pathTargetOf } from "./tool-registry.js";
 import { indexOfUnescaped, lastIndexOfUnescaped, parsePermissionRule } from "./permission-rule-syntax.js";
-import { NAME_RULE_FACES, PATH_RULE_BASE_LABEL, PATH_RULE_FACES, callPathFaceOf, isUsablePathBase, nameRuleAdmits, nameRuleSubjectOf, parseRuleText, programRunReachOf, ruleBasesNeeded, ruleToolGrammarOf } from "./permission-rule-model.js";
+import { COMMAND_RULE_TOOL, NAME_RULE_FACES, PATH_RULE_BASE_LABEL, PATH_RULE_FACES, callPathFaceOf, isUsablePathBase, laneToolNamesOf, nameRuleAdmits, nameRuleSubjectOf, parseRuleText, programRunReachOf, ruleBasesNeeded, ruleToolGrammarOf } from "./permission-rule-model.js";
 import { pathFamilyOf } from "../tools/fs/safety.js";
 import { callTargetReadingOf, callTargetViewsOf } from "./effective-path-target.js";
 import { bindPathRules, pathRowsReach, policyAnchors, rowsWhereTheyLead } from "./path-rule-binding.js";
 import { ruleDenialSentence } from "./rule-denial-sentence.js";
 import { heldValues } from "./tool-name-readings.js";
 export { parsePermissionRule };
-export const BASH_GENERIC_PARAMS = new Set(catalogRuleFaceOf("Bash")?.params ?? []);
 function describeBehavior(v) {
     switch (typeof v) {
         case "undefined": return "undefined";
@@ -110,13 +109,14 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
         return { face, judged: face !== undefined };
     };
     const byTool = new Map();
+    const command = { deny: [], ask: [] };
     const namespacedCovering = { deny: [], ask: [] };
     const issues = [];
     const bad = (rule, code, message) => {
         issues.push({ rule, code, message });
     };
     if (rules.length > caps.maxRules) {
-        return { byTool, namespacedCovering, issues: [{ rule: "", code: "invalid.cap_exceeded", message: `${rules.length} rules > maxRules ${caps.maxRules}` }] };
+        return { byTool, command, namespacedCovering, issues: [{ rule: "", code: "invalid.cap_exceeded", message: `${rules.length} rules > maxRules ${caps.maxRules}` }] };
     }
     for (const r of rules) {
         const text = r.rule;
@@ -174,17 +174,24 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
         }
         const content = parsed.ruleContent;
         const colon = content.indexOf(":");
-        if (toolName === "Bash") {
+        if (isShellFaceToolName(toolName)) {
             const paramPart = colon > 0 ? content.slice(0, colon).trim() : "";
-            const looksLikeParamRule = colon > 0 && /^[A-Za-z_][A-Za-z0-9_]*$/.test(paramPart) && BASH_GENERIC_PARAMS.has(paramPart);
-            if (!looksLikeParamRule || content.endsWith(":*")) {
+            const declaresParam = (tool) => colon > 0 && /^[A-Za-z_][A-Za-z0-9_]*$/.test(paramPart) && (catalogRuleFaceOf(tool)?.params ?? []).includes(paramPart);
+            const looksLikeParamRule = declaresParam(toolName);
+            if (toolName !== COMMAND_RULE_TOOL && !looksLikeParamRule) {
+                const commandWordParam = declaresParam(COMMAND_RULE_TOOL) && !content.endsWith(":*");
+                bad(text, "invalid.command_rule", commandWordParam
+                    ? `"${text}" is a parameter rule on "${paramPart}", which ${toolName} does not declare (its rule parameters: ${(catalogRuleFaceOf(toolName)?.params ?? []).join(", ")}); a parameter rule reaches only the tool that declares the parameter, so ${COMMAND_RULE_TOOL}(${content}) is a rule on ${COMMAND_RULE_TOOL}'s own argument and does not reach ${toolName}. A shell command rule is written ${COMMAND_RULE_TOOL}(<command>) — it reaches ${toolName} and every other tool that runs a shell command by the command it runs.`
+                    : `a shell command rule is written ${COMMAND_RULE_TOOL}(…) — it reaches ${toolName} and every other tool that runs a shell command by the command it runs; "${text}" names no rule upstream reads. Write ${COMMAND_RULE_TOOL}(${content}).`);
+                continue;
+            }
+            if (toolName === COMMAND_RULE_TOOL && (!looksLikeParamRule || content.endsWith(":*"))) {
                 const parsedCommand = parseRuleText(text, verb);
                 if ("reject" in parsedCommand) {
                     bad(text, "invalid.command_rule", `${parsedCommand.reject.code}: ${parsedCommand.reject.message}`);
                     continue;
                 }
-                entry.content[verb].push({ parsed: parsedCommand.rule, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
-                byTool.set(toolName, entry);
+                command[verb].push({ parsed: parsedCommand.rule, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
                 continue;
             }
         }
@@ -264,7 +271,7 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
         entry.param[verb].push({ param, pattern, behavior: verb, ruleText: text, source: r.source });
         byTool.set(toolName, entry);
     }
-    return { byTool, namespacedCovering, issues };
+    return { byTool, command, namespacedCovering, issues };
 }
 export function validatePermissionRules(rules, opts) {
     const caps = { ...DEFAULT_CAPS, ...opts?.caps };
@@ -303,7 +310,7 @@ const NO_LEADS = new Map();
 export function createPermissionRulePolicy(rules, opts) {
     const caps = { ...DEFAULT_CAPS, ...opts?.caps };
     const pathBases = opts?.pathBases ?? {};
-    const { byTool, namespacedCovering, issues } = compile(rules, caps, opts?.primaryFieldGeneric ?? "reject", opts?.ruleFaces, pathBases);
+    const { byTool, command, namespacedCovering, issues } = compile(rules, caps, opts?.primaryFieldGeneric ?? "reject", opts?.ruleFaces, pathBases);
     const setLevelCap = issues.some((i) => i.code === "invalid.cap_exceeded" && i.rule === "");
     if (issues.length > 0 && ((opts?.onInvalidRule ?? "throw") === "throw" || setLevelCap)) {
         const e = new Error(`createPermissionRulePolicy: ${issues.length} invalid/unsupported rule(s):\n` +
@@ -335,6 +342,9 @@ export function createPermissionRulePolicy(rules, opts) {
         if (entry.bare.ask !== undefined || entry.param.ask.length > 0 || entry.content.ask.length > 0)
             nameSets.ask.push(toolName);
     }
+    for (const behavior of ["deny", "ask"])
+        if (command[behavior].length > 0 && !nameSets[behavior].includes(COMMAND_RULE_TOOL))
+            nameSets[behavior].push(COMMAND_RULE_TOOL);
     for (const behavior of ["deny", "ask"]) {
         for (const r of namespacedCovering[behavior])
             nameSets[behavior].push(r.ruleName);
@@ -345,11 +355,13 @@ export function createPermissionRulePolicy(rules, opts) {
         deny: [...byTool.values()].flatMap((e) => e.content.deny.filter((r) => r.faces !== undefined)),
         ask: [...byTool.values()].flatMap((e) => e.content.ask.filter((r) => r.faces !== undefined)),
     };
-    const contentLaneOf = (behavior, entry, callFace) => [
+    const contentLaneOf = (behavior, entry, shellCall, callFace) => [
         ...(entry?.content[behavior].filter((r) => r.faces === undefined) ?? []),
+        ...(shellCall ? command[behavior] : []),
         ...(callFace !== undefined ? faceRules[behavior].filter((r) => r.faces.includes(callFace)) : []),
     ];
-    const commandParam = catalogRuleFaceOf("Bash")?.primaryParams[0] ?? "command";
+    const hasCommandRules = command.deny.length > 0 || command.ask.length > 0;
+    const commandParam = catalogRuleFaceOf(COMMAND_RULE_TOOL)?.primaryParams[0] ?? "command";
     const pathRuleOf = new Map();
     for (const e of byTool.values()) {
         for (const behavior of ["deny", "ask"]) {
@@ -450,7 +462,8 @@ export function createPermissionRulePolicy(rules, opts) {
                     return { action: "deny", message: ruleDenial(req, coveringDeny.ruleText, coveringDeny.source) };
             }
             const callFace = faceRules.deny.length > 0 || faceRules.ask.length > 0 ? callPathFaceOf(req) : undefined;
-            const denyLane = contentLaneOf("deny", entry, callFace);
+            const shellCall = hasCommandRules && laneToolNamesOf(req).includes(COMMAND_RULE_TOOL);
+            const denyLane = contentLaneOf("deny", entry, shellCall, callFace);
             const contentDeny = denyLane.length > 0 ? contentHit(denyLane, req) : undefined;
             if (contentDeny !== undefined && contentDeny.unreadable === undefined) {
                 return { action: "deny", message: ruleDenial(req, contentDeny.rule.ruleText, contentDeny.rule.source) };
@@ -473,7 +486,7 @@ export function createPermissionRulePolicy(rules, opts) {
                 if (coveringAsk)
                     return { action: "ask", message: ruleAskMessage(coveringAsk.ruleText, coveringAsk.source), matchedAskRule: coveringAsk.ruleText };
             }
-            const askLane = contentLaneOf("ask", entry, callFace);
+            const askLane = contentLaneOf("ask", entry, shellCall, callFace);
             const contentAsk = askLane.length > 0 ? contentHit(askLane, req) : undefined;
             if (contentAsk !== undefined) {
                 if (contentAsk.unreadable !== undefined)

package/dist/core/runner/gate-exit.d.ts

@@ -23,7 +23,7 @@
  */
 import { type ClassifierDenyCause, type DeniedBy, type GateOutcome, type ModeRefusal, type ModeRelease, type Settlement } from "../gate-outcome.js";
 import type { AutoModeClassifierRound } from "../auto-mode.js";
-import { type Arbitration, type AskClassification, type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
+import { type Arbitration, type AskClassification, type AskFace, type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import type { SafeNotifier } from "../safe-notify.js";
 import type { HookSeatOutcome, PermissionDeniedPayload, PreToolUseResult, ToolGateInput, ToolGateResult } from "../hooks.js";
@@ -143,6 +143,9 @@ export interface PreToolUseScreening {
     /** The model-facing text for an answer the decision receipt refused (an ENGINE fail-closed, not the face's deny). */
     refusedReason(answer: PreToolUseResult): string;
 }
+/** The FACE a pass's questions are put on ({@link askFaceOf} of the call's wire name) — the one reading of it the
+ *  write-protection tighten (the fold) and every class derivation (the lanes) make. */
+export declare function passAskFace(pass: Pick<GatePass, "req">): AskFace;
 /**
  * ONE gate pass — the record the station groups (`runGateFold`, `runGateLanes`) and the exits read and write,
  * built once per call by `runToolGate` before the screening pass. What used to be the closure-captured `let`

package/dist/core/runner/gate-exit.js

@@ -1,5 +1,6 @@
 import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
-import { classifyAsk, headlessApprovalRemedy } from "../ask-origin.js";
+import { askFaceOf, classifyAsk, headlessApprovalRemedy } from "../ask-origin.js";
+import { wireOf } from "../tool-name-readings.js";
 import { isProtectedWrite } from "../tool-registry.js";
 import { askUnresolvableCauseOf, classifierDenyCauseOf, classifierRoundOf, decisionText, engineSettlementOf } from "../tool-policy.js";
 import { askUnresolvableRemedySeat } from "../ask-unresolvable-notice.js";
@@ -97,6 +98,9 @@ function withParkFailureCause(reason, parkFailed) {
         `(${inlineUntrusted(parkFailed, PARK_FAILURE_CAUSE_MAX)}), so the refusal above is what the fallback had ` +
         `left to say, not the reason the call stopped.`);
 }
+export function passAskFace(pass) {
+    return askFaceOf(wireOf("gate.askFace", pass.req));
+}
 export async function engineFailClosedExit(pass, reason) {
     const { input, toolName, toolCallId, notifyPermissionDenied } = pass;
     const gate = directDeny("hook");

package/dist/core/runner/park-commit.d.ts

@@ -33,7 +33,7 @@ export declare const DEFAULT_UNATTENDED_APPROVAL_TTL_MS: number;
  * A caller-supplied TTL is only a TTL if it is a finite, positive number.
  * `TaskSpec.durableApproval.ttlMs` / `resourceSuspend.ttlMs` are typed as a bare `number`, and the mint
  * arithmetic was `Date.now() + ttlMs` with NO validation — so `Number(process.env.APPROVAL_TTL_MS)` on an
- * unset/malformed env var (a config-center miss, an upstream arithmetic slip) silently produced
+ * unset/malformed env var (a web-admin miss, an upstream arithmetic slip) silently produced
  * `deadline = NaN`. Every reaper comparison is `deadline <= cutoff`, and `NaN <= anything` is FALSE, so a
  * checkpoint that LOOKS bounded (it carries a ttlMs and a deadline) became permanently IMMORTAL: no reap
  * cutoff, however far in the future, could ever expire it → a pinned session + a stranded paused VM, and

package/dist/core/runner/prepare-hands-readface.js

@@ -8,7 +8,7 @@ import { placeReadDenyAtHome } from "../../tools/fs/read-deny-home.js";
 import { createShellOverflowSpoolFence } from "../../tools/fs/fs-shared.js";
 import { createShellReadStation } from "../../tools/fs/shell-read-check.js";
 import { composeReadChecks, createFileReadStation } from "../../tools/fs/file-read-check.js";
-import { readTargetToolNames } from "../tool-registry.js";
+import { isShellFaceToolName, predictMountedToolNames, readTargetToolNames } from "../tool-registry.js";
 import { normalizeFileText } from "../../tools/fs/encoding.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
 import { deliverEngineNotice } from "../types.js";
@@ -203,6 +203,7 @@ export async function prepareHandsMount(input) {
         const handsIncludeShell = !(executionEnv instanceof StubExecutionEnv);
         const handsReadOnly = spec.handsReadOnly === true;
         backgroundTaskToolsActive = handsIncludeShell && !handsReadOnly && hasBackgroundShell(executionEnv);
+        const shellFaceHere = [...predictMountedToolNames(new Set(backgroundTaskToolsActive ? ["hands", "backgroundTasks"] : ["hands"]))].filter(isShellFaceToolName);
         wsSnapshot = resume !== undefined || !(handsIncludeShell && !handsReadOnly) ? undefined : await session.getWorkspaceState().catch(() => undefined);
         rebaseWsPath = (p) => (wsSnapshot === undefined || wsSnapshot.taskRoot === rootCanonical ? p : rebaseWorkspacePath(p, wsSnapshot.taskRoot, rootCanonical));
         if (handsIncludeShell && !handsReadOnly) {
@@ -307,7 +308,7 @@ export async function prepareHandsMount(input) {
         if (handsIncludeShell) {
             const spoolFence = handsReadOnly ? createShellOverflowSpoolFence(executionEnv) : undefined;
             const readonlyBoundary = () => spoolFence !== undefined ? { roots: [rootCanonical, ...additionalRootsCanonical, ...additionalReadRootsCanonical], cwd: rootCanonical, ...denySeat, ...writeDenySeat, alsoInside: spoolFence } : undefined;
-            shellReadTools = new Set(handsReadOnly ? ["Bash"] : backgroundTaskToolsActive ? ["Bash", "Monitor"] : ["Bash"]);
+            shellReadTools = new Set(shellFaceHere);
             shellReadStation = createShellReadStation({
                 env: executionEnv,
                 tools: shellReadTools,
@@ -400,9 +401,8 @@ export async function prepareHandsMount(input) {
                 if (seatOwned)
                     shellGatedTools.add(name);
             };
-            installShellSeat("Bash");
-            if (backgroundTaskToolsActive)
-                installShellSeat("Monitor");
+            for (const name of shellFaceHere)
+                installShellSeat(name);
         }
     }
     return {

package/dist/core/runner/prepare-policy-chain.js

@@ -14,7 +14,7 @@ import { emitTrace } from "../trace.js";
 import { skillGrantBindingMembers } from "../skill-grant.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { autoStrippedRule, cardDisclosureOf } from "../allow-entry.js";
-import { arbitrateByMode, askClassMembersOf, askMandateMember } from "../ask-origin.js";
+import { arbitrateByMode, askClassMembersOf, askFaceOf, askMandateMember } from "../ask-origin.js";
 import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
 const ancestorFacts = (ask) => ({ ...(ask ?? {}), ancestorResolved: true });
 import { headlessDenyAtFold, headlessDenyAtRecheck, INHERITED_STATION_FACTS, inheritedAskCarry, inheritedAskFallbackMessage, judgeInheritedClassifier, lateAskSettlementObserver, resolveInheritedAsk, settleDenialLimitFallback } from "./denial-limit-arms.js";
@@ -313,6 +313,7 @@ export async function preparePolicyChain(input) {
             ...(seat.sources.size > 0 ? { toolMarkSources: seat.sources } : {}),
             ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}),
             ...(face !== undefined ? { readFace: face } : {}),
+            askFace: askFaceOf(wireOf("inherited.askFace", call)),
         };
     };
     const inheritedAskEvidence = inheritedAskRuleEvidence(deps.permissionRuleStore);

package/dist/core/safety-axis-vocab.d.ts

@@ -2,7 +2,7 @@
  * `SAFETY_AXIS_VOCABULARY` — the PUBLISHED safety-axis vocabulary as a zero-logic, zero-runtime-dependency DATA
  * artifact (pure string / number / boolean literal constants).
  *
- * **design/99 center control-plane seam (2026-06-27).** The sema-registry control plane's per-field
+ * **design/99 center control-plane seam (2026-06-27).** The web-admin control plane's per-field
  * safety-classification table lives in `@sema-agent/registry-core` and, for every safety-critical config field, cites a
  * core axis VALUE (e.g. `effect: "write"`, `irreversibility: "always"`). That contract package **must not depend on
  * `@sema-agent/core` (the engine) at runtime** — so it dev-imports THIS const (test-only) and runs a conformance test

package/dist/core/safety-merge-corpus.d.ts

@@ -1,6 +1,6 @@
 import type { SessionPermissionRules } from "./session-policy-store.js";
 /**
- * design/99 (sema-registry center control-plane seam, channel review R2): the PUBLISHED golden conformance corpus
+ * design/99 (web-admin control-plane seam, channel review R2): the PUBLISHED golden conformance corpus
  * for the safety-domain MERGE predicate {@link loosenReasons}.
  *
  * THE SEAM. The center control-plane's ConfigBundle merger is a DISPATCHER: for any field it classifies

package/dist/core/session-policy-store.d.ts

@@ -67,7 +67,7 @@ export interface SessionRuleNameRefusal {
 /** Typed error from {@link SessionPolicyStore.putRules}. `conflict` = stale `expectedRev`; `loosen_forbidden`
  *  = a non-operator write tried to relax the rules; `corrupt` = a backend could not read the erase-surviving
  *  rev mark ({@link SessionPolicyStore.deleteBySession}) and refuses rather than stamp an unproven rev; the fourth
- *  code = a tool-name bucket names a retired name, a prefix-less `__` name or a peer segment no mint spells
+ *  code = a tool-name bucket names a retired name, a prefix-less `__` name or a segment no mint spells (an empty one, or a peer spelled otherwise)
  *  ({@link assertSessionRuleNamesCurrent}) — `detail` is present on that code and only on it. */
 export declare class SessionPolicyError extends Error {
     readonly code: "conflict" | "loosen_forbidden" | "corrupt" | "legacy_tool_name";
@@ -121,7 +121,8 @@ export interface SessionPolicyStore {
     /** Write the rules for a key: CAS on `expectedRev`, then the name judge ({@link assertSessionRuleNamesCurrent} —
      *  operator writes included), then, for a non-operator write over an existing row, the
      *  tighten-only check ({@link loosenReasons}) — both against the names the deployment declares it mounts its own
-     *  tools under. */
+     *  tools under. A bucket that is not a list of strings (a bare `"rm"` for `commandDeny`) throws a `TypeError` from
+     *  {@link normalizeRules} before any of those is judged, and nothing is written. */
     putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;
     /**
      * 2c session-sync: every (principal, rules) record for `sessionId` across ALL principals — `getRules`
@@ -172,7 +173,9 @@ export interface SessionPolicyStore {
  */
 declare function lexWithin(root: string, p: string): boolean;
 /** Normalize a rules object's `allowDirs` (lexical `posix.normalize`) so stored rules are `..`-free and the
- *  tighten diff compares the same canonical-ish form the runtime resolves. */
+ *  tighten diff compares the same canonical-ish form the runtime resolves. Every bucket must be a list of strings
+ *  ({@link ruleList}); a bucket that is not one throws `TypeError`, so neither bundled store (nor a durable twin that
+ *  normalizes through this function) can store a rule list the matcher would read differently from the one written. */
 export declare function normalizeRules(rules: SessionPermissionRules): SessionPermissionRules;
 /**
  * Pure tighten-only diff: the reasons `next` LOOSENS `prior` (empty ⇒ `next` is a pure tightening or no-op).

package/dist/core/session-policy-store.js

@@ -75,18 +75,36 @@ function lexWithin(root, p) {
         return true;
     return np === nr || np.startsWith(nr + "/");
 }
+function ruleList(field, value) {
+    if (value === undefined)
+        return undefined;
+    const refuse = (got) => {
+        throw new TypeError(`session rules ${field} must be an array of strings, got ${got} — a rule list is written as a list of names (["rm"], not "rm")`);
+    };
+    if (Array.isArray(value) && Array.from(value).every((entry) => typeof entry === "string")) {
+        if (value.some((entry) => entry.trim() === ""))
+            refuse("an array holding an empty or blank entry");
+        return value;
+    }
+    return refuse(Array.isArray(value) ? "an array holding an entry that is not a string" : value === null ? "null" : `a ${typeof value}`);
+}
 export function normalizeRules(rules) {
     const out = {};
-    if (rules.toolAllow !== undefined)
-        out.toolAllow = [...rules.toolAllow];
-    if (rules.toolDeny !== undefined)
-        out.toolDeny = [...rules.toolDeny];
-    if (rules.commandAllow !== undefined)
-        out.commandAllow = [...rules.commandAllow];
-    if (rules.commandDeny !== undefined)
-        out.commandDeny = [...rules.commandDeny];
-    if (rules.allowDirs !== undefined)
-        out.allowDirs = rules.allowDirs.map((d) => posix.normalize(d).replace(/\/+$/, "") || "/");
+    const toolAllow = ruleList("toolAllow", rules.toolAllow);
+    const toolDeny = ruleList("toolDeny", rules.toolDeny);
+    const commandAllow = ruleList("commandAllow", rules.commandAllow);
+    const commandDeny = ruleList("commandDeny", rules.commandDeny);
+    const allowDirs = ruleList("allowDirs", rules.allowDirs);
+    if (toolAllow !== undefined)
+        out.toolAllow = [...toolAllow];
+    if (toolDeny !== undefined)
+        out.toolDeny = [...toolDeny];
+    if (commandAllow !== undefined)
+        out.commandAllow = [...commandAllow];
+    if (commandDeny !== undefined)
+        out.commandDeny = [...commandDeny];
+    if (allowDirs !== undefined)
+        out.allowDirs = allowDirs.map((d) => posix.normalize(d).replace(/\/+$/, "") || "/");
     return out;
 }
 export function loosenReasons(prior, next, mountedToolNames = NO_DECLARED_TOOLS) {

package/dist/core/shell-wrapper-projection.js

@@ -30,7 +30,7 @@ const runsCommand = (spec) => spec.effect === "executes" || spec.value?.kind ===
 function projectRow(row) {
     const sorted = (xs) => [...new Set(xs)].sort();
     const all = spellings(row);
-    const viaShell = row.reentry?.kind === "shell" || row.launcher?.shellText === true || row.body === "first-operand" || row.body === "assignment-values" || (row.operands?.rest?.kind === "program-text" && row.operands.rest.language === "arithmetic");
+    const viaShell = row.reentry?.kind === "shell" || row.launcher?.shellText !== undefined || row.body === "first-operand" || row.body === "assignment-values" || (row.operands?.rest?.kind === "program-text" && row.operands.rest.language === "arithmetic");
     if (row.launcher === undefined) {
         if (viaShell)
             return { valueFlags: [], flags: [], commandString: [], viaShell: true };

package/dist/core/shell-wrapper-table.d.ts

@@ -114,8 +114,8 @@ export declare const SHELL_WRAPPER_TABLE: {
         readonly commandString: readonly [];
     };
     readonly watch: {
-        readonly valueFlags: readonly [];
-        readonly flags: readonly [];
+        readonly valueFlags: readonly ["--equexit", "--interval", "--shotsdir", "-n", "-q", "-s"];
+        readonly flags: readonly ["--beep", "--chgexit", "--color", "--differences", "--errexit", "--exec", "--follow", "--help", "--no-color", "--no-rerun", "--no-title", "--no-wrap", "--precise", "--version", "-C", "-b", "-c", "-e", "-f", "-g", "-h", "-p", "-r", "-t", "-v", "-w", "-x"];
         readonly commandString: readonly [];
         readonly viaShell: true;
     };
@@ -276,15 +276,15 @@ export declare const SHELL_WRAPPER_TABLE: {
         readonly commandString: readonly [];
     };
     readonly su: {
-        readonly valueFlags: readonly [];
-        readonly flags: readonly [];
-        readonly commandString: readonly [];
+        readonly valueFlags: readonly ["--group", "--shell", "--supp-group", "--whitelist-environment", "-G", "-g", "-s", "-w"];
+        readonly flags: readonly ["--fast", "--help", "--login", "--no-pty", "--preserve-environment", "--pty", "--version", "-P", "-T", "-V", "-f", "-h", "-l", "-m", "-p"];
+        readonly commandString: readonly ["--command", "--session-command", "-c"];
         readonly viaShell: true;
     };
     readonly runuser: {
-        readonly valueFlags: readonly [];
-        readonly flags: readonly [];
-        readonly commandString: readonly [];
+        readonly valueFlags: readonly ["--group", "--shell", "--supp-group", "--user", "--whitelist-environment", "-G", "-g", "-s", "-u", "-w"];
+        readonly flags: readonly ["--fast", "--help", "--login", "--no-pty", "--preserve-environment", "--pty", "--version", "-P", "-T", "-V", "-f", "-h", "-l", "-m", "-p"];
+        readonly commandString: readonly ["--command", "--session-command", "-c"];
         readonly viaShell: true;
     };
     readonly chroot: {

package/dist/core/shell-wrapper-table.js

@@ -15,7 +15,7 @@ export const SHELL_WRAPPER_TABLE = {
     timeout: { valueFlags: ["--kill-after", "--signal", "-k", "-s"], flags: ["--foreground", "--help", "--preserve-status", "--verbose", "--version", "-v"], commandString: [], duration: true },
     stdbuf: { valueFlags: ["--error", "--input", "--output", "-e", "-i", "-o"], flags: ["--help", "--version"], commandString: [] },
     xargs: { valueFlags: ["--arg-file", "--delimiter", "--max-args", "--max-chars", "--max-procs", "--process-slot-var", "-E", "-I", "-L", "-P", "-a", "-d", "-n", "-s"], flags: ["--eof", "--exit", "--help", "--interactive", "--max-lines", "--no-run-if-empty", "--null", "--open-tty", "--replace", "--show-limits", "--verbose", "--version", "-0", "-o", "-p", "-r", "-t", "-x"], attached: ["-i", "-l"], commandString: [] },
-    watch: { valueFlags: [], flags: [], commandString: [], viaShell: true },
+    watch: { valueFlags: ["--equexit", "--interval", "--shotsdir", "-n", "-q", "-s"], flags: ["--beep", "--chgexit", "--color", "--differences", "--errexit", "--exec", "--follow", "--help", "--no-color", "--no-rerun", "--no-title", "--no-wrap", "--precise", "--version", "-C", "-b", "-c", "-e", "-f", "-g", "-h", "-p", "-r", "-t", "-v", "-w", "-x"], commandString: [], viaShell: true },
     ionice: { valueFlags: ["--class", "--classdata", "--pgid", "--pid", "--uid", "-P", "-c", "-n", "-p", "-u"], flags: ["--help", "--ignore", "--version", "-V", "-h", "-t"], commandString: [] },
     setsid: { valueFlags: [], flags: ["--ctty", "--fork", "--help", "--version", "--wait", "-c", "-f", "-w"], commandString: [] },
     taskset: { valueFlags: [], flags: ["--all-tasks", "--cpu-list", "--help", "--pid", "--version", "-a", "-c", "-p"], commandString: [], positional: /^(?:0x)?[\da-f]+$|^[\d,:-]+$/i },
@@ -43,8 +43,8 @@ export const SHELL_WRAPPER_TABLE = {
     compgen: { valueFlags: [], flags: [], commandString: [], executes: ["-C", "-F"] },
     complete: { valueFlags: [], flags: [], commandString: [], executes: ["-C", "-F"] },
     busybox: { valueFlags: [], flags: [], commandString: [] },
-    su: { valueFlags: [], flags: [], commandString: [], viaShell: true },
-    runuser: { valueFlags: [], flags: [], commandString: [], viaShell: true },
+    su: { valueFlags: ["--group", "--shell", "--supp-group", "--whitelist-environment", "-G", "-g", "-s", "-w"], flags: ["--fast", "--help", "--login", "--no-pty", "--preserve-environment", "--pty", "--version", "-P", "-T", "-V", "-f", "-h", "-l", "-m", "-p"], commandString: ["--command", "--session-command", "-c"], viaShell: true },
+    runuser: { valueFlags: ["--group", "--shell", "--supp-group", "--user", "--whitelist-environment", "-G", "-g", "-s", "-u", "-w"], flags: ["--fast", "--help", "--login", "--no-pty", "--preserve-environment", "--pty", "--version", "-P", "-T", "-V", "-f", "-h", "-l", "-m", "-p"], commandString: ["--command", "--session-command", "-c"], viaShell: true },
     chroot: { valueFlags: [], flags: [], commandString: [], positional: /^/ },
     setpriv: { valueFlags: [], flags: [], commandString: [] },
     numactl: { valueFlags: [], flags: [], commandString: [] },

package/dist/core/tool-catalog-entries.js

@@ -8,7 +8,8 @@ export const TASK_LIST_TOOL_NAME = "TaskList";
 export const TODO_WRITE_TOOL_NAME = "TodoWrite";
 export const REFRESH_MCP_TOOLS_TOOL_NAME = "RefreshMcpTools";
 export const ARTIFACT_TOOL_NAME = "Artifact";
-const SHELL_RULE_FACE = { primaryParams: ["command"], params: ["command", "timeout", "description", "run_in_background"] };
+const shellRuleFace = (params) => ({ grammar: "command", primaryParams: ["command"], params });
+const SHELL_RULE_FACE = shellRuleFace(["command", "timeout", "description", "run_in_background"]);
 const c = (contractId, implementationRevision = "1") => ({ contractId, implementationRevision });
 export const TOOL_CATALOG_ENTRIES = [
     {
@@ -108,7 +109,7 @@ export const TOOL_CATALOG_ENTRIES = [
     { id: "task-stop-hands", name: "TaskStop", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"], cards: [], face: { family: "delegate", effect: "write", contract: TASK_STOP_CONTRACT } },
     { id: "task-output", name: "TaskOutput", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-output"], face: { family: "delegate", effect: "read", contract: TASK_OUTPUT_CONTRACT } },
     { id: "task-stop", name: "TaskStop", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-stop"], face: { family: "delegate", effect: "write", contract: TASK_STOP_CONTRACT } },
-    { id: "monitor", name: "Monitor", source: "builtin", definedIn: "src/tools/monitor.ts", mountedBy: ["backgroundTasks"], cards: ["monitor-start", "readonly_out_of_root", "read_unestablished"], face: { family: "other", effect: "write", contract: c("core.monitor@1"), offloadThresholdChars: 10_000 } },
+    { id: "monitor", name: "Monitor", source: "builtin", definedIn: "src/tools/monitor.ts", mountedBy: ["backgroundTasks"], cards: ["monitor-start", "readonly_out_of_root", "read_unestablished"], face: { family: "other", effect: "write", contract: c("core.monitor@1"), ruleFace: shellRuleFace(["command", "description", "timeout_ms", "persistent"]), offloadThresholdChars: 10_000 } },
     { id: "send-message", name: "SendMessage", source: "builtin", definedIn: "src/agents/send-message-tool.ts", mountedBy: ["delegation", "hostInternals", "peerLane"], cards: ["send-message"], face: { family: "protocol", effect: "write", contract: c("core.send_message@1") } },
     { id: "agent-transcript", name: "AgentTranscript", source: "builtin", definedIn: "src/agents/agent-transcript-tool.ts", mountedBy: ["delegation"], cards: ["agent-transcript"], face: { family: "delegate", effect: "read", contract: c("core.agent_transcript@1") } },
     { id: "list-agents", name: "ListAgents", source: "builtin", definedIn: "src/agents/list-agents-tool.ts", mountedBy: ["delegation", "peerLane"], cards: ["list-agents"], face: { family: "protocol", effect: "read", aliases: ["ListPeers"], contract: c("core.list_agents@1") } },

package/dist/core/tool-face.d.ts

@@ -201,7 +201,16 @@ export interface ToolFaceDeclaration {
     };
     aliases?: string[];
     pathTarget?: ToolPathTarget;
-    ruleFace?: ToolRuleFace;
+    /**
+     * The rule face ({@link ToolRuleFace}) and, for a definition whose primary parameter is a shell command line, the grammar
+     * that judges it — `grammar: "command"`, the SHELL FACE. Every `Bash(<command>)` rule (the command grammar's one spelling,
+     * deny / ask / allow, from every source) is judged on a call that answers to the name of such a definition, against that
+     * parameter; a bare `Bash` rule stays a rule on the tool of that name. Only a catalog row declares it (a caller's
+     * `ToolSpec.ruleFace` is a {@link ToolRuleFace}): the static catalog is the one place the shell face is read from.
+     */
+    ruleFace?: ToolRuleFace & {
+        readonly grammar?: "command";
+    };
     renderHints?: ToolRenderHints;
     offload?: boolean;
     offloadThresholdChars?: number;

package/dist/core/tool-name-aliases.d.ts

@@ -38,12 +38,13 @@ export declare const RULE_TOOL_NAME_VERDICTS: readonly ["current", "retired", "u
  *  - `unprefixed_namespace` — carries the `__` namespace separator with no protocol prefix. The roster cannot clear it:
  *    a caller tool name or alias carrying `__` is refused at prepare, every engine tool name is `__`-free, and every
  *    protocol tool is minted with its prefix.
- *  - `unmintable_segment` — carries a protocol prefix, but its peer segment (the server / remote agent) is not a spelling
- *    the mint produces for any peer: the name is read as written (peers compare exactly), and every mounted tool carries
- *    the minted spelling, so the name reaches none of them. `guidance` says so in one line; `currentName` is the whole name
- *    rewritten with the spelling the mint produces (`mcp__github.com__*` → `mcp__github_com__*`), absent when the peer
- *    segment is empty and there is nothing to rewrite. The tool segment after the peer is never judged: it is a literal
- *    tool name or a glob over one, and an unmatched one is the audit's advisory.
+ *  - `unmintable_segment` — carries a protocol prefix, but a segment of it is not one the mint produces: the peer segment
+ *    (the server / remote agent) is empty or not a spelling the mint produces for any peer (the name is read as written —
+ *    peers compare exactly — and every mounted tool carries the minted spelling, so the name reaches none of them), or the
+ *    tool segment is EMPTY (a trailing separator, `mcp__srv__`: no tool is minted under an empty segment). `guidance` says
+ *    so in one line; `currentName` is the whole name rewritten with the spelling the mint produces (`mcp__github.com__*` →
+ *    `mcp__github_com__*`), absent when a segment is empty and there is nothing to rewrite. A tool segment that is not empty
+ *    is never judged: it is a literal tool name or a glob over one, and an unmatched one is the audit's advisory.
  *
  * `roster` = the tool names (aliases included) the reader knows are mounted: a run's assembled roster at prepare, the
  * names a deployment DECLARES it mounts its own tools under at a session-rule store (an empty set when it declares none).
@@ -67,8 +68,8 @@ export type RuleToolNameVerdict = {
  * `undefined` for a name that is not namespaced (no protocol prefix). The peer is the first segment — EMPTY for `mcp____x` and
  * for the bare prefix, which name no peer; the tool segment is the REST of the split rejoined, so a tool whose minted segment
  * itself carries the separator (charset normalization maps `get..issue` → `get__issue`) decomposes back to one tool name, and
- * is absent when the name stops at the peer (`mcp__srv`). The one decomposition: the judgment, the covering matcher and the
- * allow-entry grammar all read a namespaced name through it.
+ * is absent when the name stops at the peer (`mcp__srv`) and EMPTY when it ends in a trailing separator (`mcp__srv__`). The
+ * one decomposition: the judgment, the covering matcher and the allow-entry grammar all read a namespaced name through it.
  */
 export declare function splitNamespacedName(name: string): {
     readonly ns: ProtocolNamespace;

package/dist/core/tool-name-aliases.js

@@ -56,6 +56,8 @@ export function splitNamespacedName(name) {
 function unmintableSegmentOf({ ns, peer, tool }) {
     if (peer === "")
         return { kind: "unmintable_segment", guidance: `the ${ns.id} name has an empty peer segment — no tool is minted under it` };
+    if (tool === "")
+        return { kind: "unmintable_segment", guidance: `the ${ns.id} name has an empty tool segment — no tool is minted under it; write ${ns.prefix}<peer> to cover every tool of a peer, or ${ns.prefix}<peer>${NAMESPACE_SEPARATOR}<tool> for one tool` };
     const minted = mintNamespacePrefix(ns, peer).slice(ns.prefix.length, -NAMESPACE_SEPARATOR.length);
     if (minted === peer)
         return undefined;