@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/permission-rule-org.js

@@ -1,5 +1,11 @@
-import { escapeForDisclosure, parseRuleText, programRunReachOf, ruleReachesProgramRun } from "./permission-rule-model.js";
+import { COMMAND_RULE_TOOL, PATH_RULE_FACES, escapeForDisclosure, parseRuleText, programRunReachOf, ruleReachesProgramRun, ruleToolGrammarOf } from "./permission-rule-model.js";
+import { isNameableToolName, ruleSpellingOf } from "./permission-rule-syntax.js";
+import { isShellFaceToolName, pathTargetOf } from "./tool-registry.js";
 import { writerOf } from "./permission-rule-store.js";
+import { canonicalize } from "./canonical-json.js";
+import { types } from "node:util";
+import { describeFault, receive } from "./mods/kernel/receive.js";
+import { DEFAULT_CAPS } from "./permission-rules.js";
 export const ORG_UNAVAILABLE_DECISION_REASON = "org_unavailable";
 export const ORG_ADJUDICATION_TIMEOUT_MS = 15_000;
 export function settleOrgVerdictWithin(p, fallback, opts) {
@@ -48,7 +54,7 @@ export function createOrgRulePartition(cfg) {
     let memoryState;
     const readState = async () => {
         const state = cfg.persistence !== undefined ? await cfg.persistence.readOrgState() : memoryState;
-        return state === undefined ? undefined : structuredClone(state);
+        return state === undefined ? undefined : orgStateCopyOf(state);
     };
     const writeState = async (state) => {
         if (cfg.persistence !== undefined)
@@ -75,7 +81,7 @@ export function createOrgRulePartition(cfg) {
                 throw new Error(`the org snapshot source did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms`);
             if ("e" in settled)
                 throw settled.e;
-            fetched = structuredClone(settled.v);
+            fetched = settled.v === undefined ? undefined : orgSnapshotCopyOf(settled.v);
         }
         catch (err) {
             fetchFailed = true;
@@ -96,29 +102,30 @@ export function createOrgRulePartition(cfg) {
                 const persisted = await guardedRead("persistence");
                 if (fetched === undefined)
                     return persisted;
-                const invalid = validateOrgSnapshot(fetched, nowMs);
-                if (invalid !== undefined) {
-                    disclosures.push(`org snapshot refused: ${invalid}; the previously installed snapshot (if any) remains in force`);
+                const judged = validateOrgSnapshot(fetched, nowMs);
+                if ("refused" in judged) {
+                    disclosures.push(`org snapshot refused: ${judged.refused}; the previously installed snapshot (if any) remains in force`);
                     return persisted;
                 }
+                const incoming = judged.admitted;
                 const persistedFloor = persisted === undefined ? undefined : antiRollbackFloor(persisted);
                 if (persisted !== undefined && !persistedMarkIsCoherent(persisted)) {
                     disclosures.push(`the durable org state carries a high-water mark (${escapeForDisclosure(persisted.revisionHighWater)}) that is not a finite number at or above its own snapshot revision (${escapeForDisclosure(persisted.snapshot?.revision)}) — the anti-rollback fence is being held at ${escapeForDisclosure(persistedFloor)} instead, and the durable state should be repaired`);
                 }
-                if (persistedFloor !== undefined && fetched.revision < persistedFloor) {
-                    disclosures.push(`org snapshot revision ${fetched.revision} is below the installed high-water mark ${escapeForDisclosure(persistedFloor)} — refusing the rollback; the current deny set is unchanged`);
+                if (persistedFloor !== undefined && incoming.revision < persistedFloor) {
+                    disclosures.push(`org snapshot revision ${incoming.revision} is below the installed high-water mark ${escapeForDisclosure(persistedFloor)} — refusing the rollback; the current deny set is unchanged`);
                     return persisted;
                 }
-                if (persisted !== undefined && fetched.revision === persisted.snapshot.revision && sameOrgPolicyContent(fetched, persisted.snapshot) && fetched.fetchedAtMs <= persisted.snapshot.fetchedAtMs) {
+                if (persisted !== undefined && incoming.revision === persisted.snapshot.revision && sameOrgPolicyAsHeld(incoming, persisted.snapshot) && incoming.fetchedAtMs <= persisted.snapshot.fetchedAtMs) {
                     return persisted;
                 }
-                if (persisted !== undefined && fetched.revision === persisted.snapshot.revision && !sameOrgPolicyContent(fetched, persisted.snapshot)) {
-                    disclosures.push(`org snapshot revision ${fetched.revision} equals the installed revision but carries DIFFERENT policy content — refusing the swap; the current deny set is unchanged`);
+                if (persisted !== undefined && incoming.revision === persisted.snapshot.revision && !sameOrgPolicyAsHeld(incoming, persisted.snapshot)) {
+                    disclosures.push(`org snapshot revision ${incoming.revision} equals the installed revision but carries DIFFERENT policy content — refusing the swap; the current deny set is unchanged`);
                     return persisted;
                 }
                 const state = {
-                    revisionHighWater: Math.max(persistedFloor !== undefined && Number.isFinite(persistedFloor) ? persistedFloor : 0, fetched.revision),
-                    snapshot: fetched,
+                    revisionHighWater: Math.max(persistedFloor !== undefined && Number.isFinite(persistedFloor) ? persistedFloor : 0, incoming.revision),
+                    snapshot: incoming,
                     installedAtMs: nowMs,
                 };
                 try {
@@ -142,21 +149,25 @@ export function createOrgRulePartition(cfg) {
                     disclosures.push(`the installed org snapshot claims a FUTURE observation time (${escapeForDisclosure(installed.snapshot.fetchedAtMs)} vs now ${decisionMs}) — org adjudication is UNAVAILABLE; the consuming gate must tighten every terminal allow to a real-approval ask`);
                     return { source: "org", status: "unavailable", rules: [], disclosures };
                 }
-                const servingRefusal = validateOrgSnapshot(installed.snapshot, decisionMs);
-                if (servingRefusal !== undefined) {
-                    disclosures.push(`the installed org snapshot (revision ${escapeForDisclosure(installed.snapshot.revision)}) does not meet this version's validator: ${servingRefusal} — org adjudication is UNAVAILABLE; the consuming gate must tighten every terminal allow to a real-approval ask`);
+                const serving = validateOrgSnapshot(installed.snapshot, decisionMs);
+                if ("refused" in serving) {
+                    disclosures.push(`the installed org snapshot (revision ${escapeForDisclosure(installed.snapshot.revision)}) does not meet this version's validator: ${serving.refused} — org adjudication is UNAVAILABLE; the consuming gate must tighten every terminal allow to a real-approval ask`);
                     return { source: "org", status: "unavailable", rules: [], disclosures };
                 }
-                if (withinBound(installed.snapshot)) {
+                const served = serving.admitted;
+                if (withinBound(served)) {
                     const freshlyInstalled = fetched !== undefined && installed.snapshot === fetched;
                     if (!freshlyInstalled && !fetchFailed && fetched === undefined) {
                         disclosures.push("org snapshot source returned no snapshot — continuing on the last-known-good");
                     }
+                    const degraded = describeUnreadableOrgRows(readListedOrgRules(served.rules).unreadable, served.revision);
+                    if (degraded !== undefined)
+                        disclosures.push(degraded);
                     return {
                         source: "org",
                         status: freshlyInstalled ? "fresh" : "last-known-good",
-                        rules: structuredClone(installed.snapshot.rules),
-                        revision: installed.snapshot.revision,
+                        rules: structuredClone(served.rules),
+                        revision: served.revision,
                         disclosures,
                     };
                 }
@@ -188,98 +199,213 @@ function persistedMarkIsCoherent(state) {
         Number.isFinite(state.snapshot.revision) &&
         state.revisionHighWater >= state.snapshot.revision);
 }
-function sameOrgPolicyContent(a, b) {
+export function sameOrgPolicyContent(a, b) {
     if (a.rules.length !== b.rules.length)
         return false;
-    return a.rules.every((r, i) => b.rules[i]?.rule === r.rule && b.rules[i]?.behavior === r.behavior);
+    const policy = (r) => canonicalize(orgRowPolicyOf(r));
+    return a.rules.every((r, i) => policy(b.rules[i]) === policy(r));
 }
-const DISCLOSED_UNENFORCEABLE_RULES = 20;
-export function unenforceableOrgRules(rules) {
-    const out = [];
-    for (const r of rules) {
-        if (typeof r?.rule !== "string" || r.rule === "")
-            continue;
-        const parsed = parseRuleText(r.rule, r.behavior);
-        if ("reject" in parsed) {
-            out.push({ rule: r.rule, code: parsed.reject.code });
-            continue;
-        }
-        if (parsed.rule.tool !== "Bash")
-            out.push({ rule: r.rule, code: "unsupported.tool" });
+function sameOrgPolicyAsHeld(a, b) {
+    return !("refused" in b) && sameOrgPolicyContent(a, b);
+}
+const DISCLOSED_UNREADABLE_ROWS = 20;
+function reachOfRowHead(text, behavior) {
+    const head = typeof text === "string" ? ruleSpellingOf(text)?.toolName : undefined;
+    if (head === undefined || !isNameableToolName(head))
+        return "every";
+    if (head === COMMAND_RULE_TOOL || isShellFaceToolName(head))
+        return { words: [COMMAND_RULE_TOOL], faces: [] };
+    if (ruleToolGrammarOf(head) === undefined)
+        return "every";
+    const column = Object.hasOwn(PATH_RULE_FACES, head) ? PATH_RULE_FACES[head]?.[behavior] : undefined;
+    return { words: [head], faces: column ?? [] };
+}
+function rowReaches(reach, words, face) {
+    if (reach === "every")
+        return true;
+    return reach.words.some((w) => words.includes(w)) || (face !== undefined && reach.faces.includes(face));
+}
+function listRefusalOf(rules) {
+    if (typeof rules === "object" && rules !== null && types.isProxy(rules))
+        return "rules is a Proxy, not an array";
+    if (!Array.isArray(rules))
+        return "rules is not an array";
+    const cap = DEFAULT_CAPS.maxRules;
+    return rules.length > cap ? `rules list has ${rules.length} entries; the cap is ${cap} — refused whole (not truncated)` : undefined;
+}
+export const ORG_ROW_POLICY_MEMBERS = Object.freeze(["rule", "behavior"]);
+const ORG_SNAPSHOT_ENVELOPE_MEMBERS = Object.freeze(["revision", "fetchedAtMs", "signature"]);
+const ORG_STATE_MEMBERS = Object.freeze(["revisionHighWater", "installedAtMs"]);
+function scalarMembersOf(value, members) {
+    const held = {};
+    if (typeof value !== "object" || value === null)
+        return held;
+    for (const k of members) {
+        const v = Object.hasOwn(value, k) ? value[k] : undefined;
+        if (typeof v === "string" || typeof v === "boolean" || v === null || (typeof v === "number" && Number.isFinite(v)))
+            held[k] = v;
     }
-    return out;
+    return held;
+}
+function orgRowPolicyOf(row) {
+    return scalarMembersOf(row, ORG_ROW_POLICY_MEMBERS);
 }
-function describeUnenforceable(unenforceable) {
-    const named = unenforceable
-        .slice(0, DISCLOSED_UNENFORCEABLE_RULES)
-        .map((u) => `"${escapeForDisclosure(u.rule)}" (${u.code})`)
+const ORG_RULES_DEPTH = 2;
+const ORG_RULES_RECEIPT = Object.freeze({ accessors: "call-once", depth: ORG_RULES_DEPTH, others: "copy", contain: true, isProxy: (v) => types.isProxy(v) });
+export function orgRuleListOf(rules) {
+    const refused = listRefusalOf(rules);
+    if (refused !== undefined)
+        return { refused };
+    const received = receive(rules, ORG_RULES_RECEIPT);
+    if (!received.ok)
+        return { refused: `rules could not be received (${describeFault(received.fault)})` };
+    const copy = received.value;
+    return { rows: Array.from({ length: copy.length }, (_, i) => orgRowPolicyOf(Object.hasOwn(copy, i) ? copy[i] : undefined)) };
+}
+export function orgSnapshotCopyOf(v) {
+    if (typeof v === "object" && v !== null && types.isProxy(v))
+        throw new Error("the snapshot is a Proxy, not data");
+    const envelope = scalarMembersOf(v, ORG_SNAPSHOT_ENVELOPE_MEMBERS);
+    const rules = typeof v === "object" && v !== null ? v.rules : undefined;
+    const refused = listRefusalOf(rules);
+    if (refused !== undefined)
+        return { ...envelope, refused };
+    const list = orgRuleListOf(rules);
+    if ("refused" in list)
+        throw new Error(`the snapshot's ${list.refused}`);
+    return { ...envelope, rules: list.rows };
+}
+function orgStateCopyOf(state) {
+    if (typeof state === "object" && state !== null && types.isProxy(state))
+        throw new Error("the persisted org state is a Proxy, not data");
+    const snapshot = typeof state === "object" && state !== null ? state.snapshot : undefined;
+    return { ...scalarMembersOf(state, ORG_STATE_MEMBERS), snapshot: orgSnapshotCopyOf(snapshot ?? null) };
+}
+function readOrgRow(row, index) {
+    const { rule: text, behavior: said } = orgRowPolicyOf(row);
+    const behavior = said === "ask" ? "ask" : "deny";
+    const unreadable = (code, detail) => ({
+        kind: "unreadable",
+        index,
+        rule: typeof text === "string" ? text : text === undefined ? "<unreadable>" : escapeForDisclosure(text),
+        code,
+        ...(detail !== undefined ? { detail } : {}),
+        behavior,
+        reach: reachOfRowHead(text, behavior),
+    });
+    if (typeof text !== "string" || text === "")
+        return unreadable("invalid.grammar", "no rule text");
+    if (said !== "deny" && said !== "ask")
+        return unreadable("invalid.grammar", said === undefined ? "no behavior" : `behavior "${escapeForDisclosure(said)}" is not deny or ask`);
+    const parsed = parseRuleText(text, said);
+    if ("reject" in parsed)
+        return unreadable(parsed.reject.code);
+    if (parsed.rule.tool !== COMMAND_RULE_TOOL)
+        return unreadable("unsupported.tool");
+    return { kind: "read", index, rule: text, behavior: said, parsed: parsed.rule };
+}
+export function readOrgRules(rules) {
+    const list = orgRuleListOf(rules);
+    if ("refused" in list)
+        return list;
+    const rows = list.rows.map((row, i) => readOrgRow(row, i + 1));
+    const unreadable = rows.filter((r) => r.kind === "unreadable");
+    return {
+        rows,
+        unreadable,
+        verdictFor(call) {
+            const words = typeof call.tool === "string" ? [call.tool] : call.tool;
+            const command = words.includes(COMMAND_RULE_TOOL) && typeof call.command === "string" ? call.command : undefined;
+            let ask;
+            let unjudged;
+            for (const row of rows) {
+                if (row.kind === "unreadable") {
+                    if (!rowReaches(row.reach, words, call.face))
+                        continue;
+                    const verdict = { behavior: row.behavior, rule: row.rule, unreadable: unreadableOrgRowReason(row) };
+                    if (row.behavior === "deny")
+                        return verdict;
+                    ask ??= verdict;
+                    continue;
+                }
+                if (command === undefined)
+                    continue;
+                const outcome = programRunReachOf(row.parsed, command);
+                if (outcome.reach === "not_reached")
+                    continue;
+                if (outcome.reach === "unreadable") {
+                    unjudged ??= { behavior: "ask", rule: row.rule, unreadable: outcome.reason };
+                    continue;
+                }
+                if (row.behavior === "deny")
+                    return { behavior: "deny", rule: row.rule };
+                ask ??= { behavior: "ask", rule: row.rule };
+            }
+            return unjudged ?? ask;
+        },
+    };
+}
+export function unenforceableOrgRules(rules) {
+    return readListedOrgRules(rules).unreadable.map((u) => ({ rule: u.rule, code: u.code }));
+}
+function readListedOrgRules(rules) {
+    const reading = readOrgRules(rules);
+    if ("refused" in reading)
+        throw new TypeError(`the org rules cannot be read: ${reading.refused}`);
+    return reading;
+}
+export function unreadableOrgRowReason(row) {
+    return `row ${row.index} of the organization snapshot is not a rule this layer reads (${row.code}${row.detail !== undefined ? `: ${row.detail}` : ""}); republish it in the shell tool's command grammar`;
+}
+export function orgUnreadableClause(reason) {
+    return `which could not be read against it (${reason})`;
+}
+export function describeUnreadableOrgRows(unreadable, revision) {
+    if (unreadable.length === 0)
+        return undefined;
+    const named = unreadable
+        .slice(0, DISCLOSED_UNREADABLE_ROWS)
+        .map((u) => `row ${u.index} "${escapeForDisclosure(u.rule)}" (${u.code}${u.detail !== undefined ? `: ${u.detail}` : ""})`)
         .join(", ");
-    const more = unenforceable.length - DISCLOSED_UNENFORCEABLE_RULES;
-    return more > 0 ? `${named} and ${more} more` : named;
+    const more = unreadable.length - DISCLOSED_UNREADABLE_ROWS;
+    return (`the org snapshot${revision !== undefined ? ` (revision ${escapeForDisclosure(revision)})` : ""} is served DEGRADED: ${unreadable.length} row(s) this layer cannot read — ${named}${more > 0 ? ` and ${more} more` : ""}; ` +
+        `each stands at its strictest reading over the calls it may reach (a deny row, or one whose behavior cannot be read, refuses them; an ask row asks a person), and every readable row stands as published — republish the named rows in the shell tool's command grammar`);
 }
-function validateOrgSnapshot(s, nowMs) {
+export function validateOrgSnapshot(s, nowMs) {
     if (typeof s.revision !== "number" || !Number.isFinite(s.revision))
-        return `revision is not a finite number (${escapeForDisclosure(s.revision)})`;
+        return { refused: `revision is not a finite number (${escapeForDisclosure(s.revision)})` };
     if (typeof s.fetchedAtMs !== "number" || !Number.isFinite(s.fetchedAtMs))
-        return `fetchedAtMs is not a finite number (${escapeForDisclosure(s.fetchedAtMs)})`;
+        return { refused: `fetchedAtMs is not a finite number (${escapeForDisclosure(s.fetchedAtMs)})` };
     if (s.fetchedAtMs > nowMs + ORG_FETCHED_AT_SKEW_ALLOWANCE_MS) {
-        return `fetchedAtMs is ${s.fetchedAtMs - nowMs}ms in the future (allowance ${ORG_FETCHED_AT_SKEW_ALLOWANCE_MS}ms) — a future-dated observation would satisfy the staleness bound indefinitely`;
+        return { refused: `fetchedAtMs is ${s.fetchedAtMs - nowMs}ms in the future (allowance ${ORG_FETCHED_AT_SKEW_ALLOWANCE_MS}ms) — a future-dated observation would satisfy the staleness bound indefinitely` };
     }
-    if (!Array.isArray(s.rules))
-        return "rules is not an array";
-    for (const r of s.rules) {
-        if (typeof r?.rule !== "string" || r.rule === "")
-            return "a rule entry carries no rule text";
-        if (r.behavior !== "deny" && r.behavior !== "ask") {
-            return `rule "${escapeForDisclosure(r.rule)}" carries behavior "${escapeForDisclosure(r.behavior)}" — the org layer has no allow bucket`;
-        }
-    }
-    const unenforceable = unenforceableOrgRules(s.rules);
-    const first = unenforceable[0];
-    if (first !== undefined) {
-        const rest = unenforceable.length > 1 ? ` (${unenforceable.length} in all — ${describeUnenforceable(unenforceable)})` : "";
-        return `rule "${escapeForDisclosure(first.rule)}" does not parse (${first.code}) — an unenforceable deny/ask must not stand as policy${rest}`;
-    }
-    return undefined;
+    return "refused" in s ? { refused: s.refused } : { admitted: s };
 }
 export function orgRuleVerdictFor(rules, call) {
-    let ask;
-    let unreadable;
-    for (const r of rules) {
-        const parsed = parseRuleText(r.rule, r.behavior);
-        if ("reject" in parsed)
-            continue;
-        if (parsed.rule.tool !== call.tool)
-            continue;
-        const outcome = programRunReachOf(parsed.rule, call.command);
-        if (outcome.reach === "not_reached")
-            continue;
-        if (outcome.reach === "unreadable") {
-            unreadable ??= { behavior: "ask", rule: r.rule, unreadable: outcome.reason };
-            continue;
-        }
-        if (r.behavior === "deny")
-            return { behavior: "deny", rule: r.rule };
-        ask ??= { behavior: "ask", rule: r.rule };
-    }
-    return unreadable ?? ask;
+    return readListedOrgRules(rules).verdictFor(call);
 }
 export function orgRuleShadows(orgRules, rule) {
     return compileOrgShadowPredicate(orgRules)(rule);
 }
 export function compileOrgShadowPredicate(orgRules) {
-    const denies = [];
-    for (const d of orgRules) {
-        if (d.behavior !== "deny")
-            continue;
-        const parsed = parseRuleText(d.rule, "deny");
-        if (!("reject" in parsed))
-            denies.push(parsed.rule);
-    }
+    const { rows } = readListedOrgRules(orgRules);
+    const denies = rows.flatMap((r) => (r.kind === "read" && r.behavior === "deny" ? [r.parsed] : []));
+    const standing = rows.flatMap((r) => (r.kind === "unreadable" && r.behavior === "deny" ? [r.reach] : []));
     return (rule) => {
-        if (rule.tool !== "Bash" || denies.length === 0)
+        if (standing.length > 0) {
+            const word = isShellFaceToolName(rule.tool) ? COMMAND_RULE_TOOL : rule.tool;
+            const target = pathTargetOf(rule.tool);
+            const faces = Object.hasOwn(PATH_RULE_FACES, rule.tool)
+                ? (PATH_RULE_FACES[rule.tool]?.allow ?? [])
+                : target !== undefined
+                    ? [target.access === "read" ? "read" : "write"]
+                    : [undefined];
+            if (standing.some((reach) => faces.some((face) => rowReaches(reach, [word], face))))
+                return true;
+        }
+        if (rule.tool !== COMMAND_RULE_TOOL || denies.length === 0)
             return false;
-        return denies.some((d) => d.tool === rule.tool && ruleReachesProgramRun(d, rule.command));
+        return denies.some((d) => ruleReachesProgramRun(d, rule.command));
     };
 }
 export function isWritablePermissionRuleStore(store) {

package/dist/core/permission-rule-session.js

@@ -1,10 +1,10 @@
-import { readRowBehavior } from "./permission-rule-model.js";
+import { readRowBehavior, RULE_ADD_ORIGINS } from "./permission-rule-model.js";
 import { isValidConsentScope, normalizePersistedRule } from "./permission-rule-store.js";
 function isValidOverlayAdd(add) {
     const a = add;
     if (typeof a?.dot?.actor !== "string" || a.dot.actor === "" || typeof a.dot.counter !== "number" || !Number.isFinite(a.dot.counter))
         return false;
-    if (a.origin !== "user" && a.origin !== "imported-cc" && a.origin !== "starter")
+    if (!RULE_ADD_ORIGINS.some((word) => a.origin === word))
         return false;
     return typeof a.createdAt === "string";
 }

package/dist/core/permission-rule-store.d.ts

@@ -45,6 +45,7 @@ import type { PersistedRule, RuleAdd, RuleDot, RuleScope, RuleTombstone } from "
 import { type RuleBehavior } from "./permission-rule-model.js";
 import type { RuleSyncDropReason, RuleQuarantineReason } from "./governance-codes.js";
 import type { StoreDurability, StoreFidelity } from "./checkpoint-store.js";
+import type { AssertAllKeysHandled } from "./ask-origin.js";
 /** One store read: the rules as persisted, their tombstones, and the revision they were read at. */
 export interface StoredRules {
     /** Rules with their FULL add sets — tombstoned dots already removed by the backend on read. */
@@ -92,6 +93,13 @@ export type RuleOwner = {
 } | {
     kind: "local-owner";
 };
+/** The owner discriminants as a value: the `kind` words of {@link RuleOwner}, both directions fenced at compile time
+ *  ({@link RuleOwnerKindsCoverEveryArm} / {@link RuleOwnerArmsCoverEveryKind}). */
+export declare const RULE_OWNER_KINDS: readonly ["principal", "local-owner"];
+/** Compile fence: an arm whose `kind` is not in {@link RULE_OWNER_KINDS} turns the argument into that word. */
+export type RuleOwnerKindsCoverEveryArm = AssertAllKeysHandled<Exclude<RuleOwner["kind"], (typeof RULE_OWNER_KINDS)[number]>>;
+/** Compile fence, the other direction: a word in {@link RULE_OWNER_KINDS} that no arm carries. */
+export type RuleOwnerArmsCoverEveryKind = AssertAllKeysHandled<Exclude<(typeof RULE_OWNER_KINDS)[number], RuleOwner["kind"]>>;
 /** Do two owners name the same bucket? */
 export declare function sameRuleOwner(a: RuleOwner, b: RuleOwner): boolean;
 /** Resolves one owner's durable partition. `undefined` ⇒ a partition that reports zero rules. This is

package/dist/core/permission-rule-store.js

@@ -3,6 +3,7 @@ import { canonicalize } from "./canonical-json.js";
 import { escapeForDisclosure, isRuleBehavior, isRuleLive, parseRuleText } from "./permission-rule-model.js";
 import { thrownText } from "./thrown-value.js";
 import { validatePath } from "./effective-path-target.js";
+export const RULE_OWNER_KINDS = Object.freeze(["principal", "local-owner"]);
 export function sameRuleOwner(a, b) {
     return a.kind === "principal" ? b.kind === "principal" && a.principal === b.principal : b.kind === "local-owner";
 }

package/dist/core/permission-rule-sync.js

@@ -1,4 +1,4 @@
-import { escapeForDisclosure, isRuleBehavior, parseRuleText } from "./permission-rule-model.js";
+import { escapeForDisclosure, isRuleBehavior, parseRuleText, RULE_ADD_ORIGINS } from "./permission-rule-model.js";
 import { applyTombstones, errText, isProjectScopeRoot, joinFrontiers, joinRuleStates, normalizePersistedRule, readRuleWriteOutcome, ruleSyncVector, sameRuleIdentity, screenRuleSyncState, writerOf, } from "./permission-rule-store.js";
 import { emitTrace } from "./trace.js";
 export const PERMISSION_RULE_SYNC_PATH = "/v1/permission-rules/sync";
@@ -273,6 +273,7 @@ function pickScopeCaptured(v) {
 function pickScope(v) {
     return pickScopeCaptured(v).scope;
 }
+const isRuleAddOrigin = (v) => RULE_ADD_ORIGINS.some((word) => v === word);
 function pickAdd(v) {
     const a = v;
     const dot = pickDot(a?.dot);
@@ -280,7 +281,7 @@ function pickAdd(v) {
     const createdAt = a?.createdAt;
     if (dot === undefined)
         return undefined;
-    if (origin !== "user" && origin !== "imported-cc" && origin !== "starter")
+    if (!isRuleAddOrigin(origin))
         return undefined;
     if (typeof createdAt !== "string")
         return undefined;

package/dist/core/permission-rules.d.ts

@@ -47,7 +47,10 @@
  * The NAME lane is the same shape for the tools of `NAME_RULE_FACES` (the `Skill` tool): a `Skill(<name>)` / `Skill(<prefix>:*)`
  * deny or ask — the reference's own spelling — compiles through the same validator (the model's name grammar) and is judged on the
  * one string the call names (`nameRuleSubjectOf`) with `nameRuleAdmits`, the reader the persisted rule store uses. The parameter
- * spelling `Skill(skill:<name>)` those tools used to take is retired: refused loudly, its sentence naming the CC form.
+ * spelling `Skill(skill:<name>)` those tools used to take is retired: refused loudly, its sentence naming the CC form. A KEYED
+ * value tool (`Artifact(action:<word>)`) takes the same lane for content keyed by its own parameter (`nameGrammarReads`); its
+ * other arguments stay on the generic `param:pattern` lane. A call of it that names no value for the key as the tool reads it
+ * is refused by the key's deny or ask rule (`keyedValueAbsentReason`, the persisted lane's reading).
  *
  * 🔴 与 CC 的有意差(design/127 r2):
  *  - CC 参数级 generic 道无 allow lane(gnn 只有 deny/ask)—— 我们同样,且整个 policy 无 allow 臂。
@@ -126,6 +129,9 @@ export interface PermissionRuleCaps {
      *  的热路径成本上界。 */
     maxScalarValueChars: number;
 }
+/** The caps a rule set is held to unless the caller names its own — `maxRules` is the ONE bound on how many rules a set
+ *  carries, read by the compiler here and by the org layer's list judgment (which refuses a longer list before it is copied). */
+export declare const DEFAULT_CAPS: Readonly<PermissionRuleCaps>;
 export interface PermissionRulePolicyOptions {
     /** Invalid/unsupported rules: `"throw"`(default — 部署作者写错要立刻知道)aggregates ALL issues
      *  into one error; `"skip"` drops them (pair with {@link validatePermissionRules} for a report, and/or

package/dist/core/permission-rules.js

@@ -2,9 +2,10 @@ import { attest } from "./tool-policy.js";
 import { MCP_NAMESPACE, protocolOf } from "./protocol-table.js";
 import { catalogRuleFaceOf, isShellFaceToolName, pathTargetOf } from "./tool-registry.js";
 import { indexOfUnescaped, lastIndexOfUnescaped, parsePermissionRule, ruleSpellingOf } from "./permission-rule-syntax.js";
-import { COMMAND_RULE_TOOL, NAME_RULE_FACES, PATH_RULE_BASE_LABEL, PATH_RULE_FACES, callPathFaceOf, isUsablePathBase, laneToolNamesOf, nameRuleAdmits, nameRuleSubjectOf, parseRuleText, programRunReachOf, ruleBasesNeeded, ruleToolGrammarOf } from "./permission-rule-model.js";
+import { COMMAND_RULE_TOOL, NAME_RULE_FACES, PATH_RULE_BASE_LABEL, PATH_RULE_FACES, callPathFaceOf, isUsablePathBase, keyedValueAbsentReason, laneToolNamesOf, nameGrammarReads, nameRuleAdmits, nameRuleSubjectOf, parseRuleText, programRunReachOf, ruleBasesNeeded } from "./permission-rule-model.js";
 import { pathFamilyOf } from "../tools/fs/safety.js";
-import { callTargetReadingOf, callTargetViewsOf } from "./effective-path-target.js";
+import { argsAsTheToolReads, callTargetReadingOf, callTargetViewsOf } from "./effective-path-target.js";
+import { canonicalize, UNCANONICALIZABLE } from "./canonical-json.js";
 import { bindPathRules, judgeRuleRows, policyAnchors, rowsWhereTheyLead } from "./path-rule-binding.js";
 import { ruleDenialSentence } from "./rule-denial-sentence.js";
 import { heldValues } from "./tool-name-readings.js";
@@ -24,7 +25,7 @@ function describeBehavior(v) {
         default: return v === null ? "null" : "an object";
     }
 }
-const DEFAULT_CAPS = {
+export const DEFAULT_CAPS = {
     maxRules: 256,
     maxRuleLength: 512,
     maxPatternLength: 256,
@@ -164,7 +165,7 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
                 continue;
             }
             const face = resolved.face;
-            if (ruleToolGrammarOf(toolName) === "name") {
+            if (nameGrammarReads(toolName, content)) {
                 const parsedName = parseRuleText(text, verb);
                 if ("reject" in parsedName) {
                     bad(text, "invalid.command_rule", `${parsedName.reject.code}: ${parsedName.reject.message}`);
@@ -242,12 +243,16 @@ export function validatePermissionRules(rules, opts) {
 function isPlainObjectArgs(args) {
     return typeof args === "object" && args !== null && !Array.isArray(args);
 }
-function matchParamRules(rules, args, maxScalarValueChars) {
+function matchParamRules(rules, req, maxScalarValueChars) {
+    const args = req.args;
     if (!isPlainObjectArgs(args))
         return undefined;
     for (const r of rules) {
-        if (!Object.hasOwn(args, r.param))
+        if (!Object.hasOwn(args, r.param)) {
+            if (readingAbsorbs(req, r.param, r.pattern))
+                return r;
             continue;
+        }
         const raw = args[r.param];
         if (raw === undefined || raw === null)
             continue;
@@ -262,6 +267,17 @@ function matchParamRules(rules, args, maxScalarValueChars) {
     }
     return undefined;
 }
+function readingAbsorbs(req, param, pattern) {
+    if (pattern.includes("*"))
+        return false;
+    try {
+        const read = canonicalize(argsAsTheToolReads(req, { ...req.args, [param]: pattern }));
+        return read !== UNCANONICALIZABLE && read === canonicalize(req.args);
+    }
+    catch {
+        return false;
+    }
+}
 function ruleDenial(req, ruleText, source) {
     return ruleDenialSentence({ source: "permission", tool: req.toolName, rule: ruleText, ...(source ? { origin: source } : {}) });
 }
@@ -387,6 +403,16 @@ export function createPermissionRulePolicy(rules, opts) {
         }
         return unreadable;
     };
+    const keylessRefusal = (entry, req) => {
+        for (const r of [...entry.content.deny, ...entry.content.ask]) {
+            if (r.parsed.match !== "name" || nameRuleSubjectOf(r.parsed.tool, req.args) !== undefined)
+                continue;
+            const absent = keyedValueAbsentReason(r.parsed.tool);
+            if (absent !== undefined)
+                return ruleDenialSentence({ source: "permission", tool: req.toolName, rule: r.ruleText, ...(r.source ? { origin: r.source } : {}), detail: absent });
+        }
+        return undefined;
+    };
     const unreadableAsk = (hit, lane, req) => ({
         action: "ask",
         message: `tool "${req.toolName}" needs approval: the call could not be read against the permission rule ${hit.rule.ruleText} (${hit.unreadable}) — a person must decide`,
@@ -433,11 +459,14 @@ export function createPermissionRulePolicy(rules, opts) {
                 return face !== undefined ? attest(denied, req, { pathDenial: { rule: contentDeny.rule.ruleText, view: contentDeny.view, face } }) : denied;
             }
             if (entry) {
-                const paramDeny = matchParamRules(entry.param.deny, req.args, caps.maxScalarValueChars);
+                const paramDeny = matchParamRules(entry.param.deny, req, caps.maxScalarValueChars);
                 if (paramDeny) {
                     return { action: "deny", message: ruleDenial(req, paramDeny.ruleText, paramDeny.source) };
                 }
             }
+            const keyless = entry !== undefined ? keylessRefusal(entry, req) : undefined;
+            if (keyless !== undefined)
+                return { action: "deny", message: keyless };
             if (contentDeny?.unreadable !== undefined)
                 return unreadableAsk({ rule: contentDeny.rule, unreadable: contentDeny.unreadable }, "content_deny", req);
             if (entry) {
@@ -458,7 +487,7 @@ export function createPermissionRulePolicy(rules, opts) {
                 return { action: "ask", message: ruleAskMessage(contentAsk.rule.ruleText, contentAsk.rule.source), matchedAskRule: contentAsk.rule.ruleText };
             }
             if (entry) {
-                const paramAsk = matchParamRules(entry.param.ask, req.args, caps.maxScalarValueChars);
+                const paramAsk = matchParamRules(entry.param.ask, req, caps.maxScalarValueChars);
                 if (paramAsk) {
                     return { action: "ask", message: ruleAskMessage(paramAsk.ruleText, paramAsk.source), matchedAskRule: paramAsk.ruleText };
                 }

package/dist/core/read-only-shell.d.ts

@@ -1,4 +1,4 @@
-import { type ShellCommandShape } from "./shell-lexer.js";
+import { type ShellCommandShape } from "./shell-run-candidates.js";
 import { type LineDescriptors } from "../tools/fs/shell-read-device.js";
 /** The reader's answer: read-only, or not — with the first reason the reading stopped on (a sentence a
  *  trace or a card can show; never adjudication input). */