@sema-agent/server 6.8.0 → 7.1.0

package/dist/task-settings.js

@@ -426,18 +426,16 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
             return { toolPolicy: compose(createWorkflowPlanDenyPolicy()), handsReadOnly: true, enablePlanMode: true };
         case "acceptEdits": {
             const p = compose(fsWriteGate(true), createWorkflowAskPolicy(workflowGate?.isExempt));
-            return { ...(p ? { toolPolicy: p } : {}), ...(gate?.shellGate ? { shellGate: gate.shellGate } : {}) };
+            return p ? { toolPolicy: p } : {};
         }
         case "default":
         case "auto": {
             // (historical note kept: the pre-[816] impl fell through to base-only here — with no gate to attach,
             // acceptEdits-as-loosen could not be honored. The [820] factory inverts the frame: default now ADDS an ask
             // gate and acceptEdits ADDS a narrower one, both tighten-safe under the deny-wins fold.)
-            // [1557]§四: gate.shellGate opt-in(absent = pre-此批行为 byte-for-byte)rides alongside the fs-write ask
-            // gate on the SAME "CC manual" modes — closes the "echo > file bypasses the write gate" hole (cli[1555]②)
-            // when the deployment explicitly opts in (config MANUAL_MODE_SHELL_GATE).
+            // ([1557]§四 的 shellGate 便车已随 #153 搬 governance 层——见 FsWriteGateWiring 尾注。)
             const p = compose(fsWriteGate(false), createWorkflowAskPolicy(workflowGate?.isExempt));
-            return { ...(p ? { toolPolicy: p } : {}), ...(gate?.shellGate ? { shellGate: gate.shellGate } : {}) };
+            return p ? { toolPolicy: p } : {};
         }
         case "bypassPermissions":
         case undefined:
@@ -454,27 +452,17 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
  *
  * Returns `base` untouched when the parsed settings project nothing onto the spec.
  */
-// [1557]§四: core's tightenTaskSpec THROWS TaskSpecTightenError when an override's shellGate ranks LOWER than
-// base's (its contract is "the override must itself tighten", not "take the stricter of the two" — unlike
-// handsReadOnly, which ORs). Red-first repro: tightenTaskSpec({shellGate:"always"}, {shellGate:"classify"})
-// throws — so a deployment that layers autonomy=ask (→"always") UNDER this opt-in (→"classify") would 422
-// EVERY request on that mode. Mirrors core's own SHELL_GATE_RANK (tighten-task-spec.js) — only pass the
-// override through when it would not be a downgrade; otherwise the baseline already covers it (tightenTaskSpec's
-// base-only branch keeps `base.shellGate` unchanged either way — omitting is behaviorally identical, never a
-// silent weakening, just avoids the throw).
-const SHELL_GATE_RANK = { off: 0, classify: 1, always: 2 };
+// ([1557]§四 的 SHELL_GATE_RANK 副本与 shellGateSafe 守卫已随 #153 搬 runtime-governance ——
+// settings 折叠不再触碰 TaskSpec.shellGate,base 上 governance 层施加的值原样透传。)
 export function applyTaskSettings(base, settings, gate, workflowGate) {
-    const { toolPolicy, handsReadOnly, enablePlanMode, shellGate } = deriveSettingsPolicy(settings, gate, workflowGate);
-    const shellGateSafe = shellGate !== undefined && SHELL_GATE_RANK[shellGate] >= SHELL_GATE_RANK[base.shellGate ?? "off"] ? shellGate : undefined;
+    const { toolPolicy, handsReadOnly, enablePlanMode } = deriveSettingsPolicy(settings, gate, workflowGate);
     let next = base;
-    if (toolPolicy !== undefined || handsReadOnly !== undefined || shellGateSafe !== undefined) {
+    if (toolPolicy !== undefined || handsReadOnly !== undefined) {
         const overrides = {};
         if (toolPolicy !== undefined)
             overrides.toolPolicy = toolPolicy;
         if (handsReadOnly !== undefined)
             overrides.handsReadOnly = handsReadOnly;
-        if (shellGateSafe !== undefined)
-            overrides.shellGate = shellGateSafe; // [1557]§四 opt-in; rank-guarded above
         next = tightenTaskSpec(next, overrides); // deny-wins compose + THROWS on loosen (fail-loud)
     }
     // R4: enablePlanMode (mount present_plan) is ADDITIVE — it widens NOTHING (a read-only plan workflow), so it rides

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "6.8.0",
+  "version": "7.1.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,8 +54,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.12.0",
-    "@sema-agent/registry-core": "^0.14.0",
+    "@sema-agent/core": "^5.13.0",
+    "@sema-agent/registry-core": "^0.16.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",
@@ -68,7 +68,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^6.5.0",
+    "@sema-agent/sdk": "^6.6.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",