@sema-agent/server 4.3.0 → 5.0.1

package/dist/runtime-governance.js

@@ -23,17 +23,13 @@
  * path-prefixed commands all bypass the argv[0] match (they route to `ask`, fail-closed, but are not blocked by
  * name). Real isolation is the `executionEnv` sandbox. Same caveat core documents on `createCoarseCommandNamePolicy`.
  */
-import { canonicalToolName, combinePolicies, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
-/** True when `name` names a DELEGATION tool — the subagent tool (CC-187 canonical `"Agent"`, core 1.202
- *  `DEFAULT_SUBAGENT_TOOL_NAME`; legacy alias `"Task"`). CANONICAL-space compare (`canonicalToolName`) so both
- *  spellings match — the pre-1.202 raw `!== "Task"` compare in the read-only strip (main.ts) silently stopped
- *  matching when core renamed the tool (fail-open: a plan-mode / hands-read-only parent could delegate to a
- *  WRITABLE-hands child, because core does not propagate handsReadOnly to a delegated child).
- *  core 1.257 (design/136 BREAKING): the standalone `Fork` tool is retired — a fork is now
- *  `Agent(subagent_type:"fork")`, i.e. an Agent call, already matched by DEFAULT_SUBAGENT_TOOL_NAME. */
+import { combinePolicies, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
+/** True when `name` names a DELEGATION tool — the subagent tool(CC-187 canonical `"Agent"`,core
+ *  `DEFAULT_SUBAGENT_TOOL_NAME`)。5.0.0 RB-476:折叠面退役,RAW 比对 core 单源常量——旧名("Task")
+ *  在 core roster 层响亮 miss,不再需要归一;单源常量本身就防了当年 1.202 改名时裸字符串失配的
+ *  fail-open(那个教训的解=引用常量,不是折叠)。 */
 export function isDelegationToolName(name) {
-    const c = canonicalToolName(name);
-    return c === DEFAULT_SUBAGENT_TOOL_NAME;
+    return name === DEFAULT_SUBAGENT_TOOL_NAME;
 }
 /** The hands-read-only DELEGATION STRIP (the main.ts governed-spec site, extracted here so the actual filter —
  *  not just the name predicate — is pinned by tests): core does not propagate `handsReadOnly` to a delegated
@@ -77,10 +73,9 @@ function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
     const ask = (message) => ({ action: "ask", message, decisionReason: "rule" });
     return {
         check(req) {
-            // Out of scope for non-shell tools: this gate only speaks about shell command names. Canonical-space
-            // lookup ("Bash" has no alias today — identity; uniform with every other service policy face, so a
-            // future core alias or a pre-rename durable replay can't slip the gate).
-            if (!shellTools.has(canonicalToolName(req.toolName)))
+            // Out of scope for non-shell tools: this gate only speaks about shell command names. RAW(5.0.0):
+            // live 名恒 canonical,pre-rename 重放由 core 响亮拒——折叠臂退役。
+            if (!shellTools.has(req.toolName))
                 return { action: "allow" };
             const command = req.args?.command;
             if (typeof command !== "string")
@@ -100,9 +95,9 @@ function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
  *  (letters/digits and `. _ - +`, covering `python3.11`/`docker-compose`/`g++`) and reject the rest FAIL-LOUD at
  *  config-apply. 🔴 Kept ALIGNED with the `@sema-agent/registry-core` contract-layer regex (center fixed the
  *  glob→exact contract bug in 0.1.26 + publish-validates with this SAME pattern) so the contract gate and this
- *  defense-in-depth gate agree. The dep is
- *  `^0.1.26` (additive-compatible), so an additive contract bump stays aligned; a contract regex CHANGE would
- *  need this updated in lockstep (the two layers are coupled by design, not by a frozen byte-equality guarantee). */
+ *  defense-in-depth gate agree. [2373]B-11:旧注靠「dep=^0.1.26 additive 窗」论证对齐,地板抬到 ^0.13.0 后
+ *  该论证失效——现由机器钉逐字节对表(test/runtime-governance.test.ts 读安装包正则比对),lockstep 不再
+ *  是注释请求。2026-08-02 亲核 0.13.0 dist/types.js:703:两正则逐字节相同。 */
 const VALID_COMMAND_NAME = /^[A-Za-z0-9._+-]+$/;
 /** The three legal per-command decisions (mirrors the registry `runtime.commandPolicy[].decision` enum). */
 const VALID_DECISIONS = new Set(["allow", "ask", "deny"]);

package/dist/sealed-key.d.ts

@@ -76,7 +76,7 @@ export declare function ensureSealedKeyStore(dir: string, logger?: Logger): Prom
  *
  * HONESTY over fake automation: that endpoint is ADMIN-gated, and a fleet worker only holds
  * SERVICE_PULL_TOKEN — so automatic registration works ONLY when the operator deliberately provides
- * an admin token (SEMA_REGISTRY_ADMIN_TOKEN / REGISTRY_ADMIN_TOKEN in this service's env). Without
+ * an admin token (SEMA_REGISTRY_ADMIN_TOKEN in this service's env; the REGISTRY_ADMIN_TOKEN alias was tombstoned in 5.0.0). Without
  * one we do the next-best REAL thing: print the FULL public key + id at boot (a public key is not a
  * secret) with the exact registration instructions, and warn that the web "paste key" face stays
  * dark for this host until an admin registers it. Never throws (fire-and-forget from boot).

package/dist/sealed-key.js

@@ -150,7 +150,7 @@ export async function ensureSealedKeyStore(dir, logger) {
  *
  * HONESTY over fake automation: that endpoint is ADMIN-gated, and a fleet worker only holds
  * SERVICE_PULL_TOKEN — so automatic registration works ONLY when the operator deliberately provides
- * an admin token (SEMA_REGISTRY_ADMIN_TOKEN / REGISTRY_ADMIN_TOKEN in this service's env). Without
+ * an admin token (SEMA_REGISTRY_ADMIN_TOKEN in this service's env; the REGISTRY_ADMIN_TOKEN alias was tombstoned in 5.0.0). Without
  * one we do the next-best REAL thing: print the FULL public key + id at boot (a public key is not a
  * secret) with the exact registration instructions, and warn that the web "paste key" face stays
  * dark for this host until an admin registers it. Never throws (fire-and-forget from boot).

package/dist/security.d.ts

@@ -3,8 +3,6 @@ import { type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
 import type { TaskRequestBody } from "./http/wire-types.js";
 import type { StagingHandle } from "./session-sync-kernel.js";
-export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
-export type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 /** One row of the session-list projection (CC /resume picker) — the durable session abstraction's enumeration
  *  output (§0.5). Mirrors {@link RunStore}'s shipped `SessionSummary` shape so the wire response is unchanged. */
 export interface SessionListItem {
@@ -215,7 +213,4 @@ export declare function ssoVerifiedPrincipal(req: IncomingMessage): string | und
 export declare function setSsoScope(req: IncomingMessage, scope: string): void;
 export declare function ssoVerifiedScope(req: IncomingMessage): string | undefined;
 export declare function verifiedPrincipal(req: IncomingMessage, config: ServiceConfig): string | undefined;
-export { memoryScopeFor, memoryEngineRemoteLanePosture, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
-export { approvalHmacMessage, MAX_APPROVAL_REASON_CHARS, verifyApprovalHmac } from "./approval-hmac.js";
-export { verifyPrincipalJwt, approvalBnd, verifyDirectDoorProof } from "./principal-jwt.js";
 //# sourceMappingURL=security.d.ts.map

package/dist/security.js

@@ -3,9 +3,8 @@ import { PROJECT_ID_REGEX } from "@sema-agent/registry-core";
 // design/158 A4: the env→key-set decoders (parseApprovalHmacKeys / parsePrincipalJwks + their row types) moved to
 // the leaf ./auth-keys.js so config.ts's env-load no longer value-imports this whole auth module (lens2 §F). The
 // verifiers that consume the parsed key-sets now live in ./approval-hmac.js / ./principal-jwt.js (design/158 A13);
-// the four names are RE-EXPORTED for compat.
-export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
-import { memoryScopeFor } from "./memory-scope.js"; // design/158 N17: see re-export block below (moved to ./memory-scope.js)
+// import all four names from ./auth-keys.js directly ([2354] 兼容面全清 — the compat re-export here is gone).
+import { memoryScopeFor } from "./memory-scope.js"; // design/158 N17: moved to ./memory-scope.js (this file's createAuthorizer still calls it)
 // design/158 A13: the approval-envelope HMAC (integrity) group and the principal-JWT/direct-door (identity)
 // group moved VERBATIM to ./approval-hmac.js and ./principal-jwt.js respectively — this file's own
 // `verifiedPrincipal` still calls verifyPrincipalJwt for the direct-door branch (value import below); every
@@ -333,15 +332,12 @@ export function verifiedPrincipal(req, config) {
 }
 // design/158 N17: memoryScopeFor / memoryEngineRemoteLanePosture / memoryEngineBackendFor / memorySpecForRequest
 // moved VERBATIM to the leaf ./memory-scope.js (security.ts's name says auth; these four resolve memory-plane
-// config, unrelated). Re-exported here so existing importers (main.ts, config.ts, http/server.ts, run-local.ts,
-// index.ts, tests) keep working untouched — this file's own createAuthorizer below still calls memoryScopeFor.
-export { memoryScopeFor, memoryEngineRemoteLanePosture, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
-// design/158 A13: approval-envelope HMAC (integrity, {@link verifyApprovalHmac}/{@link approvalHmacMessage}/
-// MAX_APPROVAL_REASON_CHARS) and principal-JWT/direct-door proof (identity, {@link verifyPrincipalJwt}/
+// config, unrelated). Import them from ./memory-scope.js directly ([2354] 兼容面全清 — the compat re-export here
+// is gone); this file's own createAuthorizer below still calls memoryScopeFor.
+// design/158 A13: approval-envelope HMAC (integrity, verifyApprovalHmac/approvalHmacMessage/
+// MAX_APPROVAL_REASON_CHARS) and principal-JWT/direct-door proof (identity, verifyPrincipalJwt/
 // approvalBnd/verifyDirectDoorProof) moved VERBATIM to ./approval-hmac.js and ./principal-jwt.js — this file
 // keeps only the authenticator/principal-shape/SSO-mount group (createAuthorizer, verifiedPrincipal,
-// assertPrincipalShape, principalFrom, setSsoPrincipal/setSsoScope) plus this re-export so existing
-// importers of the moved names keep working unchanged.
-export { approvalHmacMessage, MAX_APPROVAL_REASON_CHARS, verifyApprovalHmac } from "./approval-hmac.js";
-export { verifyPrincipalJwt, approvalBnd, verifyDirectDoorProof } from "./principal-jwt.js";
+// assertPrincipalShape, principalFrom, setSsoPrincipal/setSsoScope). Import the moved names from their
+// new homes directly ([2354] 兼容面全清 — the compat re-exports here are gone).
 //# sourceMappingURL=security.js.map

package/dist/session-sync.d.ts

@@ -30,8 +30,6 @@ export interface FileSnapshotImportFace {
  *  seam is absent (an older/in-memory dev store). Callers gate on the RETURN VALUE, not a separate `typeof` check,
  *  so there is exactly one place that knows the shape of the probe. */
 export declare function fileSnapshotImportFace(fs: unknown): FileSnapshotImportFace | undefined;
-export { stagingIdFor, STAGING_ID_MARKER, realIdOfStaging, classifySyncRelationship, classifySyncRelationshipByIds, SyncConflictError } from "./session-sync-kernel.js";
-export type { StagingHandle, ImportStagingStore, SyncRelation } from "./session-sync-kernel.js";
 /**
  * The portable state of ONE session, ready to replay into another backend. Blobs are deliberately NOT inlined
  * (§5: a turn's working-tree blobs can be tens of MiB → OOM/413 if buffered); each snapshot carries only its

package/dist/session-sync.js

@@ -12,15 +12,6 @@ export function fileSnapshotImportFace(fs) {
         return undefined;
     return { importManifest: candidate.bind(fs) };
 }
-// ── PURE KERNEL moved to ./session-sync-kernel.ts (design/158 A2) ─────────────────────────────────────────────
-// The §7 relation classifier (classifySyncRelationship[ByIds]), the staging-id scheme (stagingIdFor /
-// STAGING_ID_MARKER / realIdOfStaging), the StagingHandle / ImportStagingStore contracts and SyncConflictError
-// lived here (lines ~26–187) but depend on NOTHING in this repo — while THIS module value-imports StoreBackend and
-// type-imports security's OwnerAwareSessionStore. The three DB session adapters (local/pg/tidb) and security.ts
-// need only those pure symbols, and security.ts importing them from HERE formed the repo's only true type cycle
-// (security ↔ session-sync; lens2 §B/§E). They now live in the leaf module session-sync-kernel.ts (same shape as
-// session-sync-content.ts) and are RE-EXPORTED verbatim below, so existing importers of this module keep working.
-export { stagingIdFor, STAGING_ID_MARKER, realIdOfStaging, classifySyncRelationship, classifySyncRelationshipByIds, SyncConflictError } from "./session-sync-kernel.js";
 /** Narrow `backend.session()` to the optional ownership/export seam (the concrete TiDB/PG/Local stores carry it;
  *  the bare in-memory dev store doesn't → the methods are optional, exactly like the fork route narrows). */
 function ownerAware(backend) {
@@ -77,7 +68,8 @@ export async function exportSession(sessionId, srcBackend) {
     // snapshots — listKeys → per-key manifest. exportManifest may be absent (no snapshot export seam) → no snapshots.
     const fs = srcBackend.fileSnapshot();
     const snapshots = [];
-    if (typeof fs.listKeys === "function" && typeof fs.exportManifest === "function") {
+    // [2373]B-5b:core 接口 listKeys 必填(恒真半支删);exportManifest? 可选——探测只留真可选的那半。
+    if (typeof fs.exportManifest === "function") {
         const keys = await fs.listKeys(sessionId);
         for (const key of keys) {
             const manifest = await fs.exportManifest(sessionId, key);
@@ -93,9 +85,9 @@ export async function exportSession(sessionId, srcBackend) {
         : [];
     // anchors — every E18 resume anchor (eventId→entryId + source owner). resumeAnchor is REQUIRED on all backends.
     const anchorStore = srcBackend.resumeAnchor();
-    const anchors = typeof anchorStore.listBySession === "function"
-        ? await anchorStore.listBySession(sessionId)
-        : [];
+    // [2373]B-5a:ResumeAnchorStore 是三实现的闭合联合、listBySession 全必填——feature-detect 恒真,
+    // `: []` 臂不可达([2195] deleteBySession 同判据,那轮漏了这对双胞胎)。直调。
+    const anchors = await anchorStore.listBySession(sessionId);
     // getBlob — bound to the SOURCE snapshot store so the importer pulls bytes content-addressed (deduped), lazily.
     // A source without getBlob (no blobs to move) supplies a getter that always returns undefined → snapshots with a
     // missing blob fail the §10 validation below before any write (never a partial restore).
@@ -131,7 +123,8 @@ export async function exportSessionManifest(sessionId, srcBackend) {
     // snapshots / policy / anchors — IDENTICAL to exportSession (no entry payloads loaded anywhere here).
     const fs = srcBackend.fileSnapshot();
     const snapshots = [];
-    if (typeof fs.listKeys === "function" && typeof fs.exportManifest === "function") {
+    // [2373]B-5b:core 接口 listKeys 必填(恒真半支删);exportManifest? 可选——探测只留真可选的那半。
+    if (typeof fs.exportManifest === "function") {
         const keys = await fs.listKeys(sessionId);
         for (const key of keys) {
             const manifest = await fs.exportManifest(sessionId, key);
@@ -145,9 +138,9 @@ export async function exportSessionManifest(sessionId, srcBackend) {
         ? await policyStore.listBySession(sessionId)
         : [];
     const anchorStore = srcBackend.resumeAnchor();
-    const anchors = typeof anchorStore.listBySession === "function"
-        ? await anchorStore.listBySession(sessionId)
-        : [];
+    // [2373]B-5a:ResumeAnchorStore 是三实现的闭合联合、listBySession 全必填——feature-detect 恒真,
+    // `: []` 臂不可达([2195] deleteBySession 同判据,那轮漏了这对双胞胎)。直调。
+    const anchors = await anchorStore.listBySession(sessionId);
     // getBlob — bound to the SOURCE snapshot store (content-addressed, lazy), exactly like exportSession.
     const getBlobFn = fs.getBlob?.bind(fs);
     const getBlob = getBlobFn ? (hash) => getBlobFn(hash) : async () => undefined;

package/dist/spec-fields.js

@@ -159,17 +159,17 @@ const skillOk = (s) => {
     }
     return true;
 };
-/** MemorySpecInput 闭合白名单(core dist/core/memory.d.ts:92 亲读)。core 的 normalizeMemorySpec 会直接
- *  迭代 `scopes` —— 非数组形状(如 {scopes:{length:1}})在服务门不拦就是 core 运行期异常(cross-review 抓获)。 */
+/** MemorySpecInput 闭合白名单(core dist/core/memory.d.ts 亲读)。core 的 normalizeMemorySpec 会直接
+ *  迭代 `scopes` —— 非数组形状(如 {scopes:{length:1}})在服务门不拦就是 core 运行期异常(cross-review 抓获)。
+ *  core 5.1.0([2390]②,原 [2387] 预告):单数 `scope` 键已删,`scopes: string[]` 唯一拼法——白名单
+ *  同步剔键,收了就是穿门死键(用户以为设了 scope,core 静默无视)。 */
 const memoryOk = (v) => {
     if (!plainObject(v))
         return false;
     for (const k of Object.keys(v)) {
-        if (k !== "scope" && k !== "scopes" && k !== "writeScope" && k !== "enabled" && k !== "scopeContract")
+        if (k !== "scopes" && k !== "writeScope" && k !== "enabled" && k !== "scopeContract")
             return false;
     }
-    if (v.scope !== undefined && typeof v.scope !== "string")
-        return false;
     if (v.scopes !== undefined && !(Array.isArray(v.scopes) && v.scopes.every((x) => typeof x === "string")))
         return false;
     if (v.writeScope !== undefined && v.writeScope !== null && typeof v.writeScope !== "string")
@@ -212,7 +212,7 @@ const TASK_AGENT_FIELD_SHAPES = {
         desc: `a positive integer of at most ${MAX_AGENT_MAX_TURNS}`,
         ok: (v) => typeof v === "number" && Number.isInteger(v) && v >= 1 && v <= MAX_AGENT_MAX_TURNS,
     },
-    memory: { desc: "a memory spec object ({ scope?, scopes?, writeScope?, enabled?, scopeContract? })", ok: memoryOk },
+    memory: { desc: "a memory spec object ({ scopes?, writeScope?, enabled?, scopeContract? })", ok: memoryOk },
     observer: { desc: `a string of at most ${MAX_AGENT_TEXT_CHARS} characters`, ok: boundedString(MAX_AGENT_TEXT_CHARS) },
     observerMessage: { desc: `a string of at most ${MAX_AGENT_TEXT_CHARS} characters`, ok: boundedString(MAX_AGENT_TEXT_CHARS) },
 };

package/dist/task-settings.d.ts

@@ -189,33 +189,6 @@ export interface FsWriteGateWiring {
      *  byte-for-byte;这是个 tighten-only opt-in,不是默认开启——运营方需要显式选择开启)。 */
     shellGate?: "always" | "classify";
 }
-/**
- * Build the per-request permission ToolPolicy from the parsed settings (mirrors shell `seam.ts` — see header).
- *  - base = name-keyed allow/deny (`createAllowDenyPolicy`): an `allow` list narrows to those tools; a `deny` list
- *    hard-blocks — composed deny-wins with an ASK-list ({@link createAskListPolicy}) so `permissions.ask` actually
- *    forces an approval gate (NOT silently dropped — review finding). `deny` > `ask` > `allow` on overlap.
- *  - `defaultMode` derive onto that base ([820]/[822] five-mode table; the fs-write gate needs `gate` wiring —
- *    without it every mode degrades to the base rules only, the pre-[816] behavior):
- *      `default`           → base + `createFsWriteGatePolicy({rootPath: cwd, exemptDirs:[scratchpad], ask})` — CC
- *                            manual: every fs write asks (the [816] P0 fix), scratchpad writes ride free.
- *      `acceptEdits`       → base + the same factory with `acceptDirs:[cwd]` — writes INSIDE the cwd subtree
- *                            auto-allow, OUTSIDE still ask (CC 207 dirname-variant card). NOT a loosen vs the
- *                            deployment: the factory only ever emits allow/ask and is folded deny-wins, so a
- *                            baseline deny/ask still wins; vs `default` it is simply a narrower CLIENT gate, and
- *                            both are client-side ADDITIONS the client may size itself.
- *      `plan`              → handsReadOnly + present_plan (unchanged; the write tools never reach an ask).
- *      `bypassPermissions` → base only, NO factory ([820] table: bypass = "不加门" not "开门" — deployment
- *                            approval/governance baselines still apply; this is exactly every mode's pre-[816]
- *                            derive, so bypass grants nothing that wasn't already granted).
- *      `auto`              → base + the `default` factory (ask 兜底) — core's auto-mode classifier (entitlement-
- *                            gated: RunnerDeps.autoMode ∧ runtimeCaps.autoMode, 1.276/1.277) screens asks UPSTREAM
- *                            of resolveAsk, allowing safe calls and leaving suspicious ones on the ask path ([822]②).
- *      absent (undefined)  → base only, NO factory: an expressed-no-mode request keeps its pre-[816] behavior
- *                            (attaching the ask gate on a mere allow/deny-list stamp would regress headless callers
- *                            that never asked for a mode; the shell always sends its mode explicitly).
- * Returns the composed ToolPolicy + whether `handsReadOnly` should tighten. Returns `undefined` policy when there
- * is no permission rule and no mode-derived gate (nothing to project).
- */
 export declare function deriveSettingsPolicy(settings: ParsedTaskSettings, gate?: FsWriteGateWiring, workflowGate?: WorkflowGateWiring): {
     toolPolicy?: ToolPolicy;
     handsReadOnly?: boolean;

package/dist/task-settings.js

@@ -35,7 +35,8 @@
  *  - (`hooks` NO LONGER deferred either — 轴B #2 注释保鲜:applied 形已接线(本文件 hooks 分片 +
  *    main.ts 单用户闸),仅 malformed 才报 deferred;旧「需要 remote hook-runner」是接线前拍照。)
  */
-import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createSensitivePathPolicy, canonicalToolName, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, } from "@sema-agent/core";
+import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createSensitivePathPolicy, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, } from "@sema-agent/core";
+import { findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 /**
  * R4: coerce a raw top-level `body.permissionMode` (the LIGHT per-turn wire — the shell sends the
@@ -247,13 +248,16 @@ export function acceptAppendSystemPrompt(v, warn, packDropsAppend) {
  *  CC-parity `permissions.ask` list — "prompt the human before THIS tool" — needs this thin policy. Composed
  *  deny-wins with the allow/deny base, so `ask` only ever tightens (a baseline `deny` still wins; `allow`→`ask`). */
 function createAskListPolicy(askNames) {
-    // Canonical-space matching, mirroring core's `createAllowDenyPolicy` (1.202): a rule written against a legacy
-    // alias ("MultiEdit"/"Task") keeps asking after a CC-parity rename, and a durable-resume replay carrying a
-    // pre-rename `req.toolName` can't slip a rule written in the new names (ask only ever tightens — widening-safe).
-    const askSet = new Set(askNames.map(canonicalToolName));
+    // RAW matching (core 5.0.0 RB-476 — the canonicalToolName fold is GONE): the rule name is compared to
+    // `req.toolName` verbatim, no alias folding in either direction. A rule written against a retired alias
+    // ("MultiEdit"/"Task") therefore matches NOTHING — which is why such a list is rejected up front
+    // ({@link rejectUnmatchableSettingsNames}) instead of being silently mounted as a no-op gate.
+    // (旧注写的 "Canonical-space matching, mirroring core's createAllowDenyPolicy (1.202)" 是折叠面还在时的
+    //  拍照,与下面这行 RAW 代码整段矛盾——同批改正,连同 :348 的 "canonical toolName key space"。)
+    const askSet = new Set(askNames);
     return {
         check(req) {
-            return askSet.has(canonicalToolName(req.toolName))
+            return askSet.has(req.toolName)
                 ? { action: "ask", message: `tool "${req.toolName}" requires approval by your settings`, decisionReason: "rule" }
                 : { action: "allow" };
         },
@@ -266,7 +270,7 @@ function createAskListPolicy(askNames) {
 /** [1245]/[1247]③ — the mode-derived dynamic-workflow ask gate (CC "Run a dynamic workflow?" dialog, engine half).
  *  core mounts `run_workflow` with effect="write" and NO exemption in the gate stack, but the mode-derived leg here
  *  only ever gated fs writes — so manual/default mode ran workflows un-asked ([1245] clay dogfood). This leg keys
- *  the canonical name (`Workflow`; run_workflow/RunWorkflow aliases fold in via canonicalToolName on BOTH sides)
+ *  the canonical name(`Workflow`;5.0.0:旧拼法 aliases 已随 core RB-476 退役,raw 直比)
  *  and attaches on default/auto/acceptEdits, independent of the fs-gate wiring (workflow gating is not
  *  fs-dependent — sandbox lanes get it too). acceptEdits asks ON PURPOSE: CC's acceptEdits auto-allows file edits
  *  only, a workflow confirmation is not an edit ([1248]② — cli to verify against the 212 live shell; flip there
@@ -277,16 +281,17 @@ const WORKFLOW_ASK_NAMES = ["Workflow"];
 function createWorkflowAskPolicy(isExempt) {
     return {
         async check(req) {
-            if (canonicalToolName(req.toolName) !== "Workflow")
+            if (req.toolName !== "Workflow")
                 return { action: "allow" };
             // codex F2 (durable lane): the "don't ask again this session" grant (decide remember="session" →
             // approvalExemptionStore) is probed at the POLICY layer here — the durable lane parks every policy `ask`
             // and its own exempt probe only covers the deployment policy's asks, so without this probe a remembered
             // Workflow approval would re-park on every later call. Same posture as the fs-write gate's isExempt
-            // (canonical toolName key space, one grant serves all layers); a THROWN probe ⇒ not exempt (fail-closed).
+            // (RAW toolName key space — 5.0.0 折叠面退役后各层比对的都是 `req.toolName` 逐字,一个 grant 服务所有层
+            //  靠的是「同一个 raw 名」而不是「同一个 canonical 空间」);a THROWN probe ⇒ not exempt (fail-closed).
             if (isExempt) {
                 try {
-                    if (await isExempt(canonicalToolName(req.toolName)))
+                    if (await isExempt(req.toolName))
                         return { action: "allow", decisionReason: "rule" };
                 }
                 catch {
@@ -307,7 +312,7 @@ function createWorkflowAskPolicy(isExempt) {
 function createWorkflowPlanDenyPolicy() {
     return {
         check(req) {
-            return canonicalToolName(req.toolName) === "Workflow"
+            return req.toolName === "Workflow"
                 ? { action: "deny", message: `Plan mode is active — "${req.toolName}" is a write/mutating tool and is read-only-blocked.`, decisionReason: "rule" }
                 : { action: "allow" };
         },
@@ -341,11 +346,37 @@ function createWorkflowPlanDenyPolicy() {
  * Returns the composed ToolPolicy + whether `handsReadOnly` should tighten. Returns `undefined` policy when there
  * is no permission rule and no mode-derived gate (nothing to project).
  */
+/**
+ * A3 — the per-request leg of the ONE "this name can never match a live tool" judgment (single source:
+ * config.ts {@link findUnmatchableToolNames}; the other two legs are the `APPROVAL_*` env vars, which reject at
+ * boot, and the center-published `runtime.approvalRequire`, which rejects that domain and keeps the prior value).
+ *
+ * WHY this leg exists: `ask`/`deny` are mounted as RAW name comparisons (`createAskListPolicy` /
+ * core's `createAllowDenyPolicy`, the 5.0.0 fold removal), so a retired name ("Task"/"bash"/"KillShell") or a
+ * pre-prefix/incomplete MCP name ("figma__x"/"mcp__figma") mounts a gate that matches NOTHING — the caller
+ * believes it added an approval gate or a hard block and got neither. That is the FAIL-OPEN direction, and it was
+ * silent on this leg. Throwing here surfaces as a 422 at the HTTP boundary (resolve-spec already wraps every
+ * throw out of `applyTaskSettings`), i.e. the same fail-loud posture the other two legs have.
+ *
+ * `allow` is deliberately NOT judged: it is a WHITELIST — a name that matches nothing leaves the allowlist
+ * effectively empty, so every tool falls to "not in the allowlist" and is DENIED. That fails closed and is
+ * immediately visible to the caller, which is a different (and acceptable) failure mode from a silent hole.
+ */
+function rejectUnmatchableSettingsNames(perms) {
+    for (const [field, names] of [["permissions.ask", perms.ask], ["permissions.deny", perms.deny]]) {
+        if (!names)
+            continue;
+        const bad = findUnmatchableToolNames(names);
+        if (bad.length > 0)
+            throw new Error(formatUnmatchableToolNames(field, bad));
+    }
+}
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
     const perms = settings.permissions;
     if (!perms)
         return {};
     const { allow, deny, ask, defaultMode } = perms;
+    rejectUnmatchableSettingsNames(perms);
     // The base name-keyed gate: allow/deny via core's helper + an ask-list (FINDING-1: `ask` must enforce, not drop).
     // Each is composed deny-wins (`deny` > `ask` > `allow`), so the fold can only ever tighten.
     const policies = [];

package/dist/tool-approval.d.ts

@@ -1,4 +1,4 @@
-import { type AskRequest } from "@sema-agent/core";
+import { type AskRequest, type AskOutcome } from "@sema-agent/core";
 /** A live approval frame delivered to whoever tails this run's stream. `type` IS the SSE event name (named-event
  *  convention, same as question). The shell renders `tool_approval` as the CC three-choice card and dismisses on
  *  `tool_approval_complete`. */
@@ -103,7 +103,7 @@ export declare class ToolApprovalCoordinator {
      *  approverUnavailable 回路把这只 ask 交回 suspendAsk 走 durable park(park 设施缺席的部署 core 自己
      *  fail-closed deny)。1.199 的「durable 部署不 wire onAsk」止血就此撤除:恒 wire,park 与 live 卡两全。
      *  Arrow property so it can be passed as `onAsk: coordinator.ask` with `this` bound. */
-    ask: (req: AskRequest, signal?: AbortSignal) => Promise<boolean | "unavailable">;
+    ask: (req: AskRequest, signal?: AbortSignal) => Promise<AskOutcome>;
     /** [1535] server 半场(审批链战役,[1539] 定谳断点①的修;[1546] HIGH-1 broker 形):宿主 sync
      *  streaming 腿在装配点以本闭包挂 `spec.onAsk`;core 继承链(parentConstraints 冻结
      *  `spec.onAsk ?? deps.onAsk`,1.294 起)把它逐 ancestor 冻给每个委派子代——子代(bg/嵌套孙代)的
@@ -115,7 +115,7 @@ export declare class ToolApprovalCoordinator {
         owner: string | null;
         taskId: string;
         sessionId?: string;
-    }) => ((req: AskRequest, signal?: AbortSignal) => Promise<boolean | "unavailable">);
+    }) => ((req: AskRequest, signal?: AbortSignal) => Promise<AskOutcome>);
     /** 广播版裁决路径——`ask()`(ALS,恒单元素数组)与 `boundAsk`([1559]四多活集合,可能多元素)共用。
      *  全体 `ctxs` 保证同一 (owner, sessionId)(streamKey 分组不变式;单元素数组平凡成立)。
      *

package/dist/tool-approval.js

@@ -41,7 +41,7 @@
  * and asks are turn-blocking by construction — the TTL bounds the human-side exposure instead.
  */
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, canonicalToolName } from "@sema-agent/core";
+import { uuidv7 } from "@sema-agent/core";
 import { redactDeep, redactSecrets } from "./trace/redact.js";
 /** Size bound on the redacted args payload in a `tool_approval` frame (parity with question's MAX_QUESTIONS_BYTES).
  *  Over the cap ⇒ the frame still goes out WITHOUT args (`argsOmitted: true`) — unlike a question (undisplayable ⇒
@@ -53,17 +53,17 @@ const DEFAULT_APPROVAL_TTL_MS = 5 * 60_000;
 /** Bound on the remembered allow-all grants (insertion-order evict — a long-lived worker must not grow unbounded). */
 const MAX_ALLOW_SESSIONS = 4096;
 /** The fs-write tool family the session allow-all collapses into ONE capability bucket (canonical space — a
- *  legacy-alias rule or a durable-resume replay carrying a pre-rename toolName still matches; MultiEdit canonicalizes
- *  to Edit). Mirrors core's PATH_WRITE_TOOLS + NotebookEdit (the same set `createFsWriteGatePolicy` gates); NOT
- *  exported by core's index, so the names are pinned here deliberately. */
-const FS_WRITE_TOOLS = new Set(["Write", "Edit", "NotebookEdit"].map(canonicalToolName));
+ *  5.0.0 RB-476:折叠面退役,三名即 CC canonical(旧拼法在 core roster 层响亮 miss)。Mirrors core's
+ *  PATH_WRITE_TOOLS + NotebookEdit (the same set `createFsWriteGatePolicy` gates); NOT exported by core's
+ *  index, so the names are pinned here deliberately. */
+const FS_WRITE_TOOLS = new Set(["Write", "Edit", "NotebookEdit"]);
 /** The session allow-all CAPABILITY CATEGORY for a tool (修2): the fs-write family shares one bucket ("fs-write" —
  *  a yes-to-edits covers Write/Edit/NotebookEdit alike, CC 207 semantics); every other tool is its OWN bucket
  *  ("tool:<canonical>") so an allow_session on it never grants anything beyond that same tool — a low-risk ask must
  *  not become a session-wide write unlock. Canonical space in, category out. */
 function sessionAllowCategory(toolName) {
-    const canonical = canonicalToolName(toolName);
-    return FS_WRITE_TOOLS.has(canonical) ? "fs-write" : `tool:${canonical}`;
+    // RAW(5.0.0):live 名恒 canonical;存量 grant 键当年也是 canonical 空间铸的,键空间不变。
+    return FS_WRITE_TOOLS.has(toolName) ? "fs-write" : `tool:${toolName}`;
 }
 /** The allow-all grant key (修2): owner + sessionId + capability category, JSON-tuple-encoded so no segment can
  *  ambiguate the boundary with the next (an owner or sessionId containing a separator can't forge another key).
@@ -396,9 +396,9 @@ export class ToolApprovalCoordinator {
         // 方法顶注。
         if (!emitSettled && lastOutcome === "expired")
             return "unavailable";
-        // [1458] updatedInput 前向兼容形:allow+编辑到位 → 以 `{allow:true, updatedInput}` 对象形返回——
-        // 旧 core(≤1.356 resolveAsk 折叠 `ok ? ALLOW`)把对象当 truthy=allow(行为=现状,编辑忽略,壳侧
-        // 版本门挡假 UI);core 放宽 OnAsk 认对象臂后(黑板转单)编辑即生效。deny 恒返 false(falsy 纪律)。
+        // [1458] 编辑放行对象臂:core AskOutcome 公开类型已含 `{allow, updatedInput?}`([1462])——
+        // 宽铸退役,真类型直返(core BAGGAGE #17 严格化前提=对象臂 allow 恒严格 true,我方满足)。
+        // deny 恒返 false(falsy 纪律)。
         if (settled.allowed && settled.updatedInput !== undefined) {
             return { allow: true, updatedInput: settled.updatedInput };
         }

package/dist/trace/artifacts.d.ts

@@ -1,3 +1,14 @@
+/**
+ * trace.artifacts (M2) — project "what the agent produced" from the durable event log.
+ *
+ * Deterministic projection, no new write path: artifacts are DERIVED from the already-persisted
+ * tool_start/tool_end pairs (S2 log), so they exist for every historical run and cannot drift from execution.
+ * v1 produces two kinds:
+ *  - `file`     — a successful `Write` / `Edit` call (deduped per path; the summary counts edits).
+ *  - `git-push` — a successful `bash` call whose command contains `git push` (ref = the parsed refspec tail).
+ * `diff` is declared in the wire schema but NOT produced in v1 (we don't capture patch bodies in the log) —
+ * consumers must treat kinds as an open set. Args in the log are already secret-redacted at persist time.
+ */
 import type { RunEvent } from "../plugins/store-contracts.js";
 export interface TraceArtifact {
     /** Stable within the task: `<taskId>:<n>` in first-seen order — safe as a UI key + dedupe handle. */

package/dist/trace/artifacts.js

@@ -1,24 +1,12 @@
-/**
- * trace.artifacts (M2) — project "what the agent produced" from the durable event log.
- *
- * Deterministic projection, no new write path: artifacts are DERIVED from the already-persisted
- * tool_start/tool_end pairs (S2 log), so they exist for every historical run and cannot drift from execution.
- * v1 produces two kinds:
- *  - `file`     — a successful `Write` / `Edit` call (deduped per path; the summary counts edits).
- *  - `git-push` — a successful `bash` call whose command contains `git push` (ref = the parsed refspec tail).
- * `diff` is declared in the wire schema but NOT produced in v1 (we don't capture patch bodies in the log) —
- * consumers must treat kinds as an open set. Args in the log are already secret-redacted at persist time.
- */
-import { canonicalToolName } from "@sema-agent/core";
 /** Line count of a tool-arg string ("" = 0; no trailing-newline inflation). */
 function lines(v) {
     if (typeof v !== "string" || v.length === 0)
         return 0;
     return v.split("\n").length;
 }
-// Q6 (core 1.161) CC names, CANONICAL only — this projection runs over HISTORICAL event logs, so `canonicalToolName`
-// folds persisted pre-rename rows (a 1.171-era "MultiEdit" start) onto their canonical spelling ("Edit") at read time.
-// core 1.202 retired MultiEdit into an Edit alias; Edit itself now carries an optional `edits[]` batch.
+// Q6 (core 1.161) CC names。5.0.0 RB-476:折叠面退役——本投影跑在历史事件日志上,pre-rename 旧行
+// (如 1.171 时代的 "MultiEdit")不再折到 canonical:旧名行按原名滑过 FILE_TOOLS 判定=不进 artifacts
+// 归类(诚实历史,读面不再兜旧名;耐久面按 [2364] 令牺牲)。
 const FILE_TOOLS = new Set(["Write", "Edit", "NotebookEdit"]);
 const GIT_PUSH_RE = /\bgit\b[^;|&]*\bpush\b\s*(.*)/;
 /** Project the durable event log into artifacts. Events must be in seq order (getEvents guarantees it). */
@@ -39,11 +27,12 @@ export function projectArtifacts(events, run) {
         if (!start)
             continue;
         starts.delete(d.toolCallId); // each call contributes at most once
-        const toolName = canonicalToolName(start.toolName); // fold persisted pre-rename rows (e.g. "MultiEdit") onto CC canonical
+        const toolName = start.toolName; // RAW(5.0.0):折叠面退役,历史旧名行按原名处理(见文件头注)
         if (FILE_TOOLS.has(toolName)) {
-            // Write/Edit key the write target on `file_path` (core 1.169 batch-B renamed `path`→`file_path`, dual-accept) —
-            // try it FIRST, fall back to `path` (a pre-1.169 emit or durable checkpoint still carries the old name), then
-            // NotebookEdit's `notebook_path` (core 1.163; unchanged by batch-B). Missing all three → not a path-bearing call.
+            // Write/Edit key the write target on `file_path`. core 5.1.0([2390])收窄 schema 为 `file_path` 单形,
+            // 但**门读侧 over-read 保留**是同批 KEEP 裁定(fail-closed 方向)——这里是耐久历史行的读侧([2373] D 类),
+            // pre-1.169 emit/旧 durable checkpoint 仍带 `path`,回落臂是对自己旧数据的容忍,不是对上游新帧的兼容。
+            // 再回落 NotebookEdit 的 `notebook_path`(core 1.163)。三键全缺 → 非带路径调用。
             const path = typeof start.args["file_path"] === "string" ? start.args["file_path"] : typeof start.args["path"] === "string" ? start.args["path"] : typeof start.args["notebook_path"] === "string" ? start.args["notebook_path"] : undefined;
             if (!path)
                 continue;

package/dist/trace/ledger-sink.js

@@ -1,5 +1,5 @@
 import { redactSecrets } from "./redact.js";
-import { toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, workspaceChangedEventData, turnEndEventData, contextUsageEventData } from "./project.js";
+import { toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, turnEndEventData, contextUsageEventData } from "./project.js";
 import { NotifiedKeys, taskNotificationStreamKey } from "../orchestration/workflow-completion-inbox.js";
 export function createLedgerSink(opts) {
     const keys = opts.notifiedKeys ?? new NotifiedKeys();
@@ -101,6 +101,12 @@ export function createLedgerSink(opts) {
                 await flush();
                 await append("steering_injected", steeringInjectedEventData(ev));
                 break;
+            case "compaction_outcome":
+                // [2373]A-2/C-2:此前 durable 双腿零 case ⇒ 回放即消失(与 [1622] label / [1611] workflowRunId
+                // 同族)。共享 builder(§E1 脱敏)三腿同源;差集门 durable-append-arm-parity 看守。
+                await flush();
+                await append("compaction_outcome", compactionOutcomeEventData(ev));
+                break;
             case "workspace_changed":
                 // [1559]二 core 裁定:design/99 §E13 旧臂,L1 门扩臂时首次撞见。durable 记账与其余内容型臂
                 // 同处置(轨迹回放时「何时 cd 到了哪」是合法历史事实,「不当持久态渲染」是 LIVE 消费端纪律,

package/dist/trace/project.d.ts

@@ -235,6 +235,17 @@ export declare function steeringInjectedEventData(ev: {
     eventId?: string;
     parentToolCallId?: string;
 }): Record<string, unknown>;
+/** `compaction_outcome`(core 2.5.0 [2105]②:压缩非 compacted 结局——manual /compact 的 mooted/failed
+ *  两条真路)。[2373]A-2/C-2:此前它是**唯一**不走共享 builder、只在 live 腿 res.write 内联挑键的
+ *  内容帧 ⇒ 两条 durable 腿零 case、回放即消失、三方普查各自失明。收进共享白名单 builder,三腿同源。
+ *  outcome/trigger=闭枚举 verbatim;reason=引擎说明文本(可能引用配置值)→ redactSecrets;identity 同款。 */
+export declare function compactionOutcomeEventData(ev: {
+    outcome?: unknown;
+    trigger?: unknown;
+    reason?: unknown;
+    eventId?: unknown;
+    parentToolCallId?: unknown;
+}): Record<string, unknown>;
 /** The `workspace_changed` payload([1559]二 core 裁定:design/99 §E13 旧臂,L1 门本车首次撞见——非新增,
  *  是本门扩 TaskEvent 臂集时第一次显式处置。语义 = bash `cd`/EnterWorktree 移动任务逻辑 cwd 后,在移动
  *  它的工具结算后发一帧,给 shell/宿主 UI 一个路径提示行。cwd 与已展示的工具 args 同信任级[UNTRUSTED,
@@ -347,6 +358,12 @@ export declare function turnEndEventData(ev: {
  *  `in` 落回旧值,读端零伤)。`uncachedIn` 只在**能确认自己踩在新契约帧上**(`totalInputTokens` 在场)时
  *  才发——旧帧的 `inputTokens` 是族依赖的旧语义,标成「uncachedIn(cache-MISS)」会是谎言。 */
 export declare function toContractTokens(usage: unknown): TraceTurn["tokens"] | undefined;
+/** [2373]C-13:tool_start/tool_end 的**共享挑键**——`projectEvents`(turns 面)与 `mapTraceEvent`
+ *  (trace SSE 面)对同一账本行的字段选择逐字同构,此前两处独立手写,structured/totalChars/label
+ *  三次扩字段各改两遍(见两处对偶注)。收一份:两面各自包装键名皮(id/name/input vs 同名),
+ *  字段集合从此单点演进。 */
+export declare function toolCallFieldsOf(d: Record<string, unknown>): Record<string, unknown>;
+export declare function toolResultFieldsOf(d: Record<string, unknown>): Record<string, unknown>;
 export interface ProjectOpts {
     /** Prepend the user turn (the objective is not in the event log; the endpoint supplies it). */
     objective?: string;