@sema-agent/core 7.52.0 → 7.53.0

package/dist/core/permission-rule-org.js

@@ -1,5 +1,11 @@
-import { escapeForDisclosure, parseRuleText, programRunReachOf, ruleReachesProgramRun } from "./permission-rule-model.js";
+import { COMMAND_RULE_TOOL, PATH_RULE_FACES, escapeForDisclosure, parseRuleText, programRunReachOf, ruleReachesProgramRun, ruleToolGrammarOf } from "./permission-rule-model.js";
+import { isNameableToolName, ruleSpellingOf } from "./permission-rule-syntax.js";
+import { isShellFaceToolName, pathTargetOf } from "./tool-registry.js";
 import { writerOf } from "./permission-rule-store.js";
+import { canonicalize } from "./canonical-json.js";
+import { types } from "node:util";
+import { describeFault, receive } from "./mods/kernel/receive.js";
+import { DEFAULT_CAPS } from "./permission-rules.js";
 export const ORG_UNAVAILABLE_DECISION_REASON = "org_unavailable";
 export const ORG_ADJUDICATION_TIMEOUT_MS = 15_000;
 export function settleOrgVerdictWithin(p, fallback, opts) {
@@ -48,7 +54,7 @@ export function createOrgRulePartition(cfg) {
     let memoryState;
     const readState = async () => {
         const state = cfg.persistence !== undefined ? await cfg.persistence.readOrgState() : memoryState;
-        return state === undefined ? undefined : structuredClone(state);
+        return state === undefined ? undefined : orgStateCopyOf(state);
     };
     const writeState = async (state) => {
         if (cfg.persistence !== undefined)
@@ -75,7 +81,7 @@ export function createOrgRulePartition(cfg) {
                 throw new Error(`the org snapshot source did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms`);
             if ("e" in settled)
                 throw settled.e;
-            fetched = structuredClone(settled.v);
+            fetched = orgSnapshotCopyOf(settled.v);
         }
         catch (err) {
             fetchFailed = true;
@@ -152,6 +158,9 @@ export function createOrgRulePartition(cfg) {
                     if (!freshlyInstalled && !fetchFailed && fetched === undefined) {
                         disclosures.push("org snapshot source returned no snapshot — continuing on the last-known-good");
                     }
+                    const degraded = describeUnreadableOrgRows(readListedOrgRules(installed.snapshot.rules).unreadable, installed.snapshot.revision);
+                    if (degraded !== undefined)
+                        disclosures.push(degraded);
                     return {
                         source: "org",
                         status: freshlyInstalled ? "fresh" : "last-known-good",
@@ -188,34 +197,187 @@ function persistedMarkIsCoherent(state) {
         Number.isFinite(state.snapshot.revision) &&
         state.revisionHighWater >= state.snapshot.revision);
 }
-function sameOrgPolicyContent(a, b) {
+export function sameOrgPolicyContent(a, b) {
     if (a.rules.length !== b.rules.length)
         return false;
-    return a.rules.every((r, i) => b.rules[i]?.rule === r.rule && b.rules[i]?.behavior === r.behavior);
+    const policy = (r) => canonicalize(orgRowPolicyOf(r));
+    return a.rules.every((r, i) => policy(b.rules[i]) === policy(r));
 }
-const DISCLOSED_UNENFORCEABLE_RULES = 20;
-export function unenforceableOrgRules(rules) {
-    const out = [];
-    for (const r of rules) {
-        if (typeof r?.rule !== "string" || r.rule === "")
-            continue;
-        const parsed = parseRuleText(r.rule, r.behavior);
-        if ("reject" in parsed) {
-            out.push({ rule: r.rule, code: parsed.reject.code });
-            continue;
-        }
-        if (parsed.rule.tool !== "Bash")
-            out.push({ rule: r.rule, code: "unsupported.tool" });
+const DISCLOSED_UNREADABLE_ROWS = 20;
+function reachOfRowHead(text, behavior) {
+    const head = typeof text === "string" ? ruleSpellingOf(text)?.toolName : undefined;
+    if (head === undefined || !isNameableToolName(head))
+        return "every";
+    if (head === COMMAND_RULE_TOOL || isShellFaceToolName(head))
+        return { words: [COMMAND_RULE_TOOL], faces: [] };
+    if (ruleToolGrammarOf(head) === undefined)
+        return "every";
+    const column = Object.hasOwn(PATH_RULE_FACES, head) ? PATH_RULE_FACES[head]?.[behavior] : undefined;
+    return { words: [head], faces: column ?? [] };
+}
+function rowReaches(reach, words, face) {
+    if (reach === "every")
+        return true;
+    return reach.words.some((w) => words.includes(w)) || (face !== undefined && reach.faces.includes(face));
+}
+function listRefusalOf(rules) {
+    if (typeof rules === "object" && rules !== null) {
+        if (types.isProxy(rules))
+            return "rules is a Proxy, not an array";
+        const held = HELD_LIST_REFUSALS.get(rules);
+        if (held !== undefined)
+            return held;
     }
-    return out;
+    if (!Array.isArray(rules))
+        return "rules is not an array";
+    const cap = DEFAULT_CAPS.maxRules;
+    return rules.length > cap ? `rules list has ${rules.length} entries; the cap is ${cap} — refused whole (not truncated)` : undefined;
+}
+export const ORG_ROW_POLICY_MEMBERS = Object.freeze(["rule", "behavior"]);
+const ORG_SNAPSHOT_ENVELOPE_MEMBERS = Object.freeze(["revision", "fetchedAtMs", "signature"]);
+const ORG_STATE_MEMBERS = Object.freeze(["revisionHighWater", "installedAtMs"]);
+function scalarMembersOf(value, members) {
+    const held = {};
+    if (typeof value !== "object" || value === null)
+        return held;
+    for (const k of members) {
+        const v = Object.hasOwn(value, k) ? value[k] : undefined;
+        if (typeof v === "string" || typeof v === "boolean" || v === null || (typeof v === "number" && Number.isFinite(v)))
+            held[k] = v;
+    }
+    return held;
+}
+function orgRowPolicyOf(row) {
+    return scalarMembersOf(row, ORG_ROW_POLICY_MEMBERS);
+}
+const ORG_RULES_DEPTH = 2;
+const ORG_RULES_RECEIPT = Object.freeze({ accessors: "call-once", depth: ORG_RULES_DEPTH, others: "copy", contain: true, isProxy: (v) => types.isProxy(v) });
+export function orgRuleListOf(rules) {
+    const refused = listRefusalOf(rules);
+    if (refused !== undefined)
+        return { refused };
+    const received = receive(rules, ORG_RULES_RECEIPT);
+    if (!received.ok)
+        return { refused: `rules could not be received (${describeFault(received.fault)})` };
+    const copy = received.value;
+    return { rows: Array.from({ length: copy.length }, (_, i) => orgRowPolicyOf(Object.hasOwn(copy, i) ? copy[i] : undefined)) };
+}
+const HELD_LIST_REFUSALS = new WeakMap();
+function heldRefusalOf(words) {
+    const held = Object.freeze({});
+    HELD_LIST_REFUSALS.set(held, words);
+    return held;
+}
+function orgSnapshotCopyOf(v) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v === "object" && v !== null && types.isProxy(v))
+        throw new Error("the snapshot is a Proxy, not data");
+    const envelope = scalarMembersOf(v, ORG_SNAPSHOT_ENVELOPE_MEMBERS);
+    const rules = typeof v === "object" && v !== null ? v.rules : undefined;
+    const refusal = listRefusalOf(rules);
+    if (refusal !== undefined)
+        return { ...envelope, rules: heldRefusalOf(refusal) };
+    const list = orgRuleListOf(rules);
+    if ("refused" in list)
+        throw new Error(`the snapshot's ${list.refused}`);
+    return { ...envelope, rules: list.rows };
+}
+function orgStateCopyOf(state) {
+    if (typeof state === "object" && state !== null && types.isProxy(state))
+        throw new Error("the persisted org state is a Proxy, not data");
+    const snapshot = typeof state === "object" && state !== null ? state.snapshot : undefined;
+    return { ...scalarMembersOf(state, ORG_STATE_MEMBERS), snapshot: orgSnapshotCopyOf(snapshot ?? null) };
+}
+function readOrgRow(row, index) {
+    const { rule: text, behavior: said } = orgRowPolicyOf(row);
+    const behavior = said === "ask" ? "ask" : "deny";
+    const unreadable = (code, detail) => ({
+        kind: "unreadable",
+        index,
+        rule: typeof text === "string" ? text : text === undefined ? "<unreadable>" : escapeForDisclosure(text),
+        code,
+        ...(detail !== undefined ? { detail } : {}),
+        behavior,
+        reach: reachOfRowHead(text, behavior),
+    });
+    if (typeof text !== "string" || text === "")
+        return unreadable("invalid.grammar", "no rule text");
+    if (said !== "deny" && said !== "ask")
+        return unreadable("invalid.grammar", said === undefined ? "no behavior" : `behavior "${escapeForDisclosure(said)}" is not deny or ask`);
+    const parsed = parseRuleText(text, said);
+    if ("reject" in parsed)
+        return unreadable(parsed.reject.code);
+    if (parsed.rule.tool !== COMMAND_RULE_TOOL)
+        return unreadable("unsupported.tool");
+    return { kind: "read", index, rule: text, behavior: said, parsed: parsed.rule };
+}
+export function readOrgRules(rules) {
+    const list = orgRuleListOf(rules);
+    if ("refused" in list)
+        return list;
+    const rows = list.rows.map((row, i) => readOrgRow(row, i + 1));
+    const unreadable = rows.filter((r) => r.kind === "unreadable");
+    return {
+        rows,
+        unreadable,
+        verdictFor(call) {
+            const words = typeof call.tool === "string" ? [call.tool] : call.tool;
+            const command = words.includes(COMMAND_RULE_TOOL) && typeof call.command === "string" ? call.command : undefined;
+            let ask;
+            let unjudged;
+            for (const row of rows) {
+                if (row.kind === "unreadable") {
+                    if (!rowReaches(row.reach, words, call.face))
+                        continue;
+                    const verdict = { behavior: row.behavior, rule: row.rule, unreadable: unreadableOrgRowReason(row) };
+                    if (row.behavior === "deny")
+                        return verdict;
+                    ask ??= verdict;
+                    continue;
+                }
+                if (command === undefined)
+                    continue;
+                const outcome = programRunReachOf(row.parsed, command);
+                if (outcome.reach === "not_reached")
+                    continue;
+                if (outcome.reach === "unreadable") {
+                    unjudged ??= { behavior: "ask", rule: row.rule, unreadable: outcome.reason };
+                    continue;
+                }
+                if (row.behavior === "deny")
+                    return { behavior: "deny", rule: row.rule };
+                ask ??= { behavior: "ask", rule: row.rule };
+            }
+            return unjudged ?? ask;
+        },
+    };
+}
+export function unenforceableOrgRules(rules) {
+    return readListedOrgRules(rules).unreadable.map((u) => ({ rule: u.rule, code: u.code }));
+}
+function readListedOrgRules(rules) {
+    const reading = readOrgRules(rules);
+    if ("refused" in reading)
+        throw new TypeError(`the org rules cannot be read: ${reading.refused}`);
+    return reading;
+}
+export function unreadableOrgRowReason(row) {
+    return `row ${row.index} of the organization snapshot is not a rule this layer reads (${row.code}${row.detail !== undefined ? `: ${row.detail}` : ""}); republish it in the shell tool's command grammar`;
+}
+export function orgUnreadableClause(reason) {
+    return `which could not be read against it (${reason})`;
 }
-function describeUnenforceable(unenforceable) {
-    const named = unenforceable
-        .slice(0, DISCLOSED_UNENFORCEABLE_RULES)
-        .map((u) => `"${escapeForDisclosure(u.rule)}" (${u.code})`)
+export function describeUnreadableOrgRows(unreadable, revision) {
+    if (unreadable.length === 0)
+        return undefined;
+    const named = unreadable
+        .slice(0, DISCLOSED_UNREADABLE_ROWS)
+        .map((u) => `row ${u.index} "${escapeForDisclosure(u.rule)}" (${u.code}${u.detail !== undefined ? `: ${u.detail}` : ""})`)
         .join(", ");
-    const more = unenforceable.length - DISCLOSED_UNENFORCEABLE_RULES;
-    return more > 0 ? `${named} and ${more} more` : named;
+    const more = unreadable.length - DISCLOSED_UNREADABLE_ROWS;
+    return (`the org snapshot${revision !== undefined ? ` (revision ${escapeForDisclosure(revision)})` : ""} is served DEGRADED: ${unreadable.length} row(s) this layer cannot read — ${named}${more > 0 ? ` and ${more} more` : ""}; ` +
+        `each stands at its strictest reading over the calls it may reach (a deny row, or one whose behavior cannot be read, refuses them; an ask row asks a person), and every readable row stands as published — republish the named rows in the shell tool's command grammar`);
 }
 function validateOrgSnapshot(s, nowMs) {
     if (typeof s.revision !== "number" || !Number.isFinite(s.revision))
@@ -225,61 +387,33 @@ function validateOrgSnapshot(s, nowMs) {
     if (s.fetchedAtMs > nowMs + ORG_FETCHED_AT_SKEW_ALLOWANCE_MS) {
         return `fetchedAtMs is ${s.fetchedAtMs - nowMs}ms in the future (allowance ${ORG_FETCHED_AT_SKEW_ALLOWANCE_MS}ms) — a future-dated observation would satisfy the staleness bound indefinitely`;
     }
-    if (!Array.isArray(s.rules))
-        return "rules is not an array";
-    for (const r of s.rules) {
-        if (typeof r?.rule !== "string" || r.rule === "")
-            return "a rule entry carries no rule text";
-        if (r.behavior !== "deny" && r.behavior !== "ask") {
-            return `rule "${escapeForDisclosure(r.rule)}" carries behavior "${escapeForDisclosure(r.behavior)}" — the org layer has no allow bucket`;
-        }
-    }
-    const unenforceable = unenforceableOrgRules(s.rules);
-    const first = unenforceable[0];
-    if (first !== undefined) {
-        const rest = unenforceable.length > 1 ? ` (${unenforceable.length} in all — ${describeUnenforceable(unenforceable)})` : "";
-        return `rule "${escapeForDisclosure(first.rule)}" does not parse (${first.code}) — an unenforceable deny/ask must not stand as policy${rest}`;
-    }
-    return undefined;
+    return listRefusalOf(s.rules);
 }
 export function orgRuleVerdictFor(rules, call) {
-    let ask;
-    let unreadable;
-    for (const r of rules) {
-        const parsed = parseRuleText(r.rule, r.behavior);
-        if ("reject" in parsed)
-            continue;
-        if (parsed.rule.tool !== call.tool)
-            continue;
-        const outcome = programRunReachOf(parsed.rule, call.command);
-        if (outcome.reach === "not_reached")
-            continue;
-        if (outcome.reach === "unreadable") {
-            unreadable ??= { behavior: "ask", rule: r.rule, unreadable: outcome.reason };
-            continue;
-        }
-        if (r.behavior === "deny")
-            return { behavior: "deny", rule: r.rule };
-        ask ??= { behavior: "ask", rule: r.rule };
-    }
-    return unreadable ?? ask;
+    return readListedOrgRules(rules).verdictFor(call);
 }
 export function orgRuleShadows(orgRules, rule) {
     return compileOrgShadowPredicate(orgRules)(rule);
 }
 export function compileOrgShadowPredicate(orgRules) {
-    const denies = [];
-    for (const d of orgRules) {
-        if (d.behavior !== "deny")
-            continue;
-        const parsed = parseRuleText(d.rule, "deny");
-        if (!("reject" in parsed))
-            denies.push(parsed.rule);
-    }
+    const { rows } = readListedOrgRules(orgRules);
+    const denies = rows.flatMap((r) => (r.kind === "read" && r.behavior === "deny" ? [r.parsed] : []));
+    const standing = rows.flatMap((r) => (r.kind === "unreadable" && r.behavior === "deny" ? [r.reach] : []));
     return (rule) => {
-        if (rule.tool !== "Bash" || denies.length === 0)
+        if (standing.length > 0) {
+            const word = isShellFaceToolName(rule.tool) ? COMMAND_RULE_TOOL : rule.tool;
+            const target = pathTargetOf(rule.tool);
+            const faces = Object.hasOwn(PATH_RULE_FACES, rule.tool)
+                ? (PATH_RULE_FACES[rule.tool]?.allow ?? [])
+                : target !== undefined
+                    ? [target.access === "read" ? "read" : "write"]
+                    : [undefined];
+            if (standing.some((reach) => faces.some((face) => rowReaches(reach, [word], face))))
+                return true;
+        }
+        if (rule.tool !== COMMAND_RULE_TOOL || denies.length === 0)
             return false;
-        return denies.some((d) => d.tool === rule.tool && ruleReachesProgramRun(d, rule.command));
+        return denies.some((d) => ruleReachesProgramRun(d, rule.command));
     };
 }
 export function isWritablePermissionRuleStore(store) {

package/dist/core/permission-rules.d.ts

@@ -47,7 +47,10 @@
  * The NAME lane is the same shape for the tools of `NAME_RULE_FACES` (the `Skill` tool): a `Skill(<name>)` / `Skill(<prefix>:*)`
  * deny or ask — the reference's own spelling — compiles through the same validator (the model's name grammar) and is judged on the
  * one string the call names (`nameRuleSubjectOf`) with `nameRuleAdmits`, the reader the persisted rule store uses. The parameter
- * spelling `Skill(skill:<name>)` those tools used to take is retired: refused loudly, its sentence naming the CC form.
+ * spelling `Skill(skill:<name>)` those tools used to take is retired: refused loudly, its sentence naming the CC form. A KEYED
+ * value tool (`Artifact(action:<word>)`) takes the same lane for content keyed by its own parameter (`nameGrammarReads`); its
+ * other arguments stay on the generic `param:pattern` lane. A call of it that names no value for the key as the tool reads it
+ * is refused by the key's deny or ask rule (`keyedValueAbsentReason`, the persisted lane's reading).
  *
  * 🔴 与 CC 的有意差(design/127 r2):
  *  - CC 参数级 generic 道无 allow lane(gnn 只有 deny/ask)—— 我们同样,且整个 policy 无 allow 臂。
@@ -126,6 +129,9 @@ export interface PermissionRuleCaps {
      *  的热路径成本上界。 */
     maxScalarValueChars: number;
 }
+/** The caps a rule set is held to unless the caller names its own — `maxRules` is the ONE bound on how many rules a set
+ *  carries, read by the compiler here and by the org layer's list judgment (which refuses a longer list before it is copied). */
+export declare const DEFAULT_CAPS: Readonly<PermissionRuleCaps>;
 export interface PermissionRulePolicyOptions {
     /** Invalid/unsupported rules: `"throw"`(default — 部署作者写错要立刻知道)aggregates ALL issues
      *  into one error; `"skip"` drops them (pair with {@link validatePermissionRules} for a report, and/or

package/dist/core/permission-rules.js

@@ -2,9 +2,10 @@ import { attest } from "./tool-policy.js";
 import { MCP_NAMESPACE, protocolOf } from "./protocol-table.js";
 import { catalogRuleFaceOf, isShellFaceToolName, pathTargetOf } from "./tool-registry.js";
 import { indexOfUnescaped, lastIndexOfUnescaped, parsePermissionRule, ruleSpellingOf } from "./permission-rule-syntax.js";
-import { COMMAND_RULE_TOOL, NAME_RULE_FACES, PATH_RULE_BASE_LABEL, PATH_RULE_FACES, callPathFaceOf, isUsablePathBase, laneToolNamesOf, nameRuleAdmits, nameRuleSubjectOf, parseRuleText, programRunReachOf, ruleBasesNeeded, ruleToolGrammarOf } from "./permission-rule-model.js";
+import { COMMAND_RULE_TOOL, NAME_RULE_FACES, PATH_RULE_BASE_LABEL, PATH_RULE_FACES, callPathFaceOf, isUsablePathBase, keyedValueAbsentReason, laneToolNamesOf, nameGrammarReads, nameRuleAdmits, nameRuleSubjectOf, parseRuleText, programRunReachOf, ruleBasesNeeded } from "./permission-rule-model.js";
 import { pathFamilyOf } from "../tools/fs/safety.js";
-import { callTargetReadingOf, callTargetViewsOf } from "./effective-path-target.js";
+import { argsAsTheToolReads, callTargetReadingOf, callTargetViewsOf } from "./effective-path-target.js";
+import { canonicalize, UNCANONICALIZABLE } from "./canonical-json.js";
 import { bindPathRules, judgeRuleRows, policyAnchors, rowsWhereTheyLead } from "./path-rule-binding.js";
 import { ruleDenialSentence } from "./rule-denial-sentence.js";
 import { heldValues } from "./tool-name-readings.js";
@@ -24,7 +25,7 @@ function describeBehavior(v) {
         default: return v === null ? "null" : "an object";
     }
 }
-const DEFAULT_CAPS = {
+export const DEFAULT_CAPS = {
     maxRules: 256,
     maxRuleLength: 512,
     maxPatternLength: 256,
@@ -164,7 +165,7 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
                 continue;
             }
             const face = resolved.face;
-            if (ruleToolGrammarOf(toolName) === "name") {
+            if (nameGrammarReads(toolName, content)) {
                 const parsedName = parseRuleText(text, verb);
                 if ("reject" in parsedName) {
                     bad(text, "invalid.command_rule", `${parsedName.reject.code}: ${parsedName.reject.message}`);
@@ -242,12 +243,16 @@ export function validatePermissionRules(rules, opts) {
 function isPlainObjectArgs(args) {
     return typeof args === "object" && args !== null && !Array.isArray(args);
 }
-function matchParamRules(rules, args, maxScalarValueChars) {
+function matchParamRules(rules, req, maxScalarValueChars) {
+    const args = req.args;
     if (!isPlainObjectArgs(args))
         return undefined;
     for (const r of rules) {
-        if (!Object.hasOwn(args, r.param))
+        if (!Object.hasOwn(args, r.param)) {
+            if (readingAbsorbs(req, r.param, r.pattern))
+                return r;
             continue;
+        }
         const raw = args[r.param];
         if (raw === undefined || raw === null)
             continue;
@@ -262,6 +267,17 @@ function matchParamRules(rules, args, maxScalarValueChars) {
     }
     return undefined;
 }
+function readingAbsorbs(req, param, pattern) {
+    if (pattern.includes("*"))
+        return false;
+    try {
+        const read = canonicalize(argsAsTheToolReads(req, { ...req.args, [param]: pattern }));
+        return read !== UNCANONICALIZABLE && read === canonicalize(req.args);
+    }
+    catch {
+        return false;
+    }
+}
 function ruleDenial(req, ruleText, source) {
     return ruleDenialSentence({ source: "permission", tool: req.toolName, rule: ruleText, ...(source ? { origin: source } : {}) });
 }
@@ -387,6 +403,16 @@ export function createPermissionRulePolicy(rules, opts) {
         }
         return unreadable;
     };
+    const keylessRefusal = (entry, req) => {
+        for (const r of [...entry.content.deny, ...entry.content.ask]) {
+            if (r.parsed.match !== "name" || nameRuleSubjectOf(r.parsed.tool, req.args) !== undefined)
+                continue;
+            const absent = keyedValueAbsentReason(r.parsed.tool);
+            if (absent !== undefined)
+                return ruleDenialSentence({ source: "permission", tool: req.toolName, rule: r.ruleText, ...(r.source ? { origin: r.source } : {}), detail: absent });
+        }
+        return undefined;
+    };
     const unreadableAsk = (hit, lane, req) => ({
         action: "ask",
         message: `tool "${req.toolName}" needs approval: the call could not be read against the permission rule ${hit.rule.ruleText} (${hit.unreadable}) — a person must decide`,
@@ -433,11 +459,14 @@ export function createPermissionRulePolicy(rules, opts) {
                 return face !== undefined ? attest(denied, req, { pathDenial: { rule: contentDeny.rule.ruleText, view: contentDeny.view, face } }) : denied;
             }
             if (entry) {
-                const paramDeny = matchParamRules(entry.param.deny, req.args, caps.maxScalarValueChars);
+                const paramDeny = matchParamRules(entry.param.deny, req, caps.maxScalarValueChars);
                 if (paramDeny) {
                     return { action: "deny", message: ruleDenial(req, paramDeny.ruleText, paramDeny.source) };
                 }
             }
+            const keyless = entry !== undefined ? keylessRefusal(entry, req) : undefined;
+            if (keyless !== undefined)
+                return { action: "deny", message: keyless };
             if (contentDeny?.unreadable !== undefined)
                 return unreadableAsk({ rule: contentDeny.rule, unreadable: contentDeny.unreadable }, "content_deny", req);
             if (entry) {
@@ -458,7 +487,7 @@ export function createPermissionRulePolicy(rules, opts) {
                 return { action: "ask", message: ruleAskMessage(contentAsk.rule.ruleText, contentAsk.rule.source), matchedAskRule: contentAsk.rule.ruleText };
             }
             if (entry) {
-                const paramAsk = matchParamRules(entry.param.ask, req.args, caps.maxScalarValueChars);
+                const paramAsk = matchParamRules(entry.param.ask, req, caps.maxScalarValueChars);
                 if (paramAsk) {
                     return { action: "ask", message: ruleAskMessage(paramAsk.ruleText, paramAsk.source), matchedAskRule: paramAsk.ruleText };
                 }

package/dist/core/retention.js

@@ -1,3 +1,4 @@
+import { describeRejectedValue } from "./tool-search-setting.js";
 export const RETENTION_CASCADE_DOMAINS = Object.freeze(["checkpoints", "session-trees", "orphan-tool-results"]);
 export const RETENTION_CASCADE_EXEMPT = Object.freeze(["session-pollution", "session-capture-optout", "lineage.json"]);
 function codedError(code, message) {
@@ -7,8 +8,12 @@ function codedError(code, message) {
 }
 export function assertRetentionCapability(input) {
     const { policy, locked, stores } = input;
+    const declared = policy;
+    if (declared !== undefined && (typeof declared !== "object" || declared === null || Array.isArray(declared))) {
+        throw codedError("config.retention_policy", `retentionPolicy must be an object carrying maxAgeDays (got ${declared === null ? "null" : Array.isArray(declared) ? "an array" : typeof declared}).`);
+    }
     if (policy !== undefined && (!Number.isFinite(policy.maxAgeDays) || policy.maxAgeDays < 0)) {
-        throw codedError("config.retention_policy", `retentionPolicy.maxAgeDays must be a finite non-negative number of days (got ${String(policy.maxAgeDays)}).`);
+        throw codedError("config.retention_policy", `retentionPolicy.maxAgeDays must be a finite non-negative number of days (got ${describeRejectedValue(policy.maxAgeDays)}).`);
     }
     const declaredRetention = (name, store) => {
         const r = store.retention;
@@ -19,7 +24,7 @@ export function assertRetentionCapability(input) {
         throw codedError("config.retention_capability", `store "${name}" declares an unparseable retention value ${JSON.stringify(r)} — expected "managed" or "none".`);
     };
     const declarations = stores
-        .filter((s) => s.store !== undefined)
+        .filter((s) => s.store !== undefined && s.store !== null)
         .map(({ name, store }) => ({ name, retention: declaredRetention(name, store) }));
     if (!locked || policy === undefined)
         return;

package/dist/core/retired-keys.d.ts

@@ -46,7 +46,13 @@ export declare const RETIRED_SHELL_READ_BOUNDARY_KEYS: Readonly<Record<string, s
  *  decision that carries one is denied in the engine's own words, never read without it: the type retires a member only where
  *  a decision is a literal in an annotated position, and a `check` whose return type is inferred still compiles with it. */
 export declare const RETIRED_DECISION_MEMBERS: Readonly<Record<string, string>>;
-/** The `ToolPolicy` door ({@link RETIRED_TOOL_POLICY_KEYS}); `undefined` is no policy. */
-export declare function assertNoRetiredToolPolicyKeys(policy: object | undefined): void;
+/**
+ * The `ToolPolicy` door — every policy the engine installs passes it (a task's or deployment's seat, a combined member, an inherited
+ * constraint): `undefined` (or `null`, the seat's other absence spelling) is no policy; a value that is not an object whose `check`
+ * is a function is no policy either, and refuses by name (`config.invalid_argument`, `detail.field: "ToolPolicy"`) — a policy the
+ * engine cannot call is never installed as if it were absent, which would run the leg with nothing the deployment meant to apply;
+ * a retired member refuses by name ({@link RETIRED_TOOL_POLICY_KEYS}).
+ */
+export declare function assertNoRetiredToolPolicyKeys(policy: unknown): void;
 /** The `ShellReadBoundary` door ({@link RETIRED_SHELL_READ_BOUNDARY_KEYS}). */
 export declare function assertNoRetiredShellReadBoundaryKeys(boundary: object): void;

package/dist/core/retired-keys.js

@@ -45,8 +45,19 @@ export const RETIRED_DECISION_MEMBERS = Object.freeze({
     guard: 'write `guards: ["<word>"]` instead (the same five words, as a list: one ask may stand on several integrity guards)',
 });
 export function assertNoRetiredToolPolicyKeys(policy) {
-    if (policy !== undefined)
+    if (policy === undefined || policy === null)
+        return;
+    const isRecord = typeof policy === "object" && !Array.isArray(policy);
+    if (isRecord)
         assertNoRetiredKeys(policy, RETIRED_TOOL_POLICY_KEYS, "ToolPolicy");
+    const check = isRecord ? policy.check : undefined;
+    if (typeof check !== "function") {
+        const got = typeof policy !== "object" ? typeof policy : Array.isArray(policy) ? "an array" : `an object whose check is ${check === null ? "null" : typeof check}`;
+        const e = new Error(`ToolPolicy must be an object whose \`check\` is a function (got ${got}) — a policy the engine cannot call is refused rather than run as no policy; omit the seat for none.`);
+        e.code = "config.invalid_argument";
+        e.detail = { field: "ToolPolicy" };
+        throw e;
+    }
 }
 export function assertNoRetiredShellReadBoundaryKeys(boundary) {
     assertNoRetiredKeys(boundary, RETIRED_SHELL_READ_BOUNDARY_KEYS, "ShellReadBoundary");