@sema-agent/server 7.0.0 → 7.1.0

package/dist/boot/resolve-spec.js

@@ -812,7 +812,13 @@ export function createResolveSpec(ctx) {
         // per-task across suspend is a larger, separate decision that must cover the approval baseline too — tracked
         // for center (adversarial-review HIGH-1), deliberately NOT a governance-only partial freeze here (that would
         // be an inconsistent false-safety: approval would still be live).
-        const governedBase = applyRuntimeGovernance(spec, { autonomy: config.autonomy, commandPolicy: config.commandPolicy });
+        // #153([2713] 分单②):MANUAL_MODE_SHELL_GATE 在此无条件施加(与 autonomy 同拍)——部署旋钮不再
+        // 依赖客户端 settings 在场性/模式臂/host lane(三重条件曾让 print/headless 腿与沙箱 lane 全静默失效)。
+        const governedBase = applyRuntimeGovernance(spec, {
+            autonomy: config.autonomy,
+            commandPolicy: config.commandPolicy,
+            ...(config.manualModeShellGate ? { manualModeShellGate: config.manualModeShellGate } : {}),
+        });
         // Fold the client's per-request settings stamp onto the governed spec, TIGHTEN-ONLY (deny-wins) — AFTER
         // the approval baseline + operator governance, so the order is deployment ⊇ operator ⊇ client (each can only
         // narrow). tightenTaskSpec THROWS if the client settings would LOOSEN a stricter baseline → a 422 client error
@@ -890,10 +896,8 @@ export function createResolveSpec(ctx) {
                         // (deny 恒赢 —— 豁免/acceptDirs 越不过;集合取舍 core 成文,server 只透传 config 旋钮:
                         // 缺省 = core RECOMMENDED_SENSITIVE_PATTERNS,SENSITIVE_WRITE_PATTERNS 显式替换/off 关闭)。
                         ...(config.sensitiveWritePatterns.length > 0 ? { sensitivePatterns: config.sensitiveWritePatterns } : {}),
-                        // [1557]§四 opt-in(cli[1555]②「Bash echo > file 绕写门」缺口的部署侧补丁):MANUAL_MODE_SHELL_GATE
-                        // 未设置时 config.manualModeShellGate 缺席,本行不传字段——deriveSettingsPolicy 的 default/
-                        // auto/acceptEdits 分支照旧不碰 TaskSpec.shellGate,零行为变化。
-                        ...(config.manualModeShellGate ? { shellGate: config.manualModeShellGate } : {}),
+                        // [1557]§四 的 shellGate 旧家已随 #153 搬到 applyRuntimeGovernance(governance 层无条件施加,
+                        // 见上方 governedBase)——wiring 不再承运该旋钮,FsWriteGateWiring.shellGate 字段一并拆除。
                         // [841]① / core 1.294 exemption seam:gate 产 ask 前查同一只 approval_exemption 店(与 decide
                         // remember="session" 的授予、ask 政策层探针同店同 canonical toolName 键空间)——「本会话不再询问」
                         // 对 fs-write 门同 turn 即时生效(父+继承子任务,ask 路径不再重入)。has() reject ⇒ core 按

package/dist/runtime-governance.d.ts

@@ -86,15 +86,23 @@ export declare function compileCommandPolicy(rules: CommandRule[] | undefined):
  */
 export declare function autonomyOverrides(autonomy: Autonomy | undefined): Partial<TaskSpec>;
 /**
- * Apply the operator's runtime governance (autonomy + commandPolicy) onto a base `TaskSpec`, TIGHTEN-ONLY, in a
- * SINGLE {@link tightenTaskSpec} call: commandPolicy compiles to a `toolPolicy` override (combined onto the
- * baseline by `tightenTaskSpec` — TRAP #1), and autonomy expands to `handsReadOnly` / `shellGate` overrides
- * (TRAP #2). `tightenTaskSpec` THROWS `TaskSpecTightenError` if any override would LOOSEN a stricter base safety
- * field — surfacing a misconfiguration loudly instead of silently weakening the gate. Returns `base` untouched
- * when there is nothing to apply (no autonomy override and no commandPolicy).
+ * Apply the operator's runtime governance (autonomy + commandPolicy + manualModeShellGate) onto a base
+ * `TaskSpec`, TIGHTEN-ONLY, in a SINGLE {@link tightenTaskSpec} call: commandPolicy compiles to a `toolPolicy`
+ * override (combined onto the baseline by `tightenTaskSpec` — TRAP #1), and autonomy expands to
+ * `handsReadOnly` / `shellGate` overrides (TRAP #2). `tightenTaskSpec` THROWS `TaskSpecTightenError` if any
+ * override would LOOSEN a stricter base safety field — surfacing a misconfiguration loudly instead of silently
+ * weakening the gate. Returns `base` untouched when there is nothing to apply.
+ *
+ * #153([2713] server 分单②):`MANUAL_MODE_SHELL_GATE` 从 settings 折叠搬到这里**无条件施加**。旧家
+ * (task-settings deriveSettingsPolicy 的 default/auto/acceptEdits 三臂)让一个**部署级 tighten-only 旋钮
+ * 的生死由客户端表态在场性决定**:body 无 settings/permissionMode(cli print/headless 腿按设计不 stamp)
+ * ⇒ 旋钮静默失效(clay 实机 Monitor 案「门根本没铸」);bypassPermissions 一句话掀掉部署闸;非 host lane
+ * fsWriteGate wiring 不建 ⇒ 沙箱 lane 全失效。governance 层与 autonomy 同拍施加后三者全闭。rank 合成:
+ * autonomy 派生值与旋钮取大(ask→"always" 压过 "classify"),再对 base 只升不降(防 tightenTaskSpec throw)。
  */
 export declare function applyRuntimeGovernance(base: TaskSpec, governance: {
     autonomy?: Autonomy;
     commandPolicy?: CommandRule[];
+    manualModeShellGate?: "always" | "classify";
 }): TaskSpec;
 //# sourceMappingURL=runtime-governance.d.ts.map

package/dist/runtime-governance.js

@@ -204,19 +204,40 @@ export function autonomyOverrides(autonomy) {
             return {};
     }
 }
+/** core `tighten-task-spec` 的 SHELL_GATE_RANK 镜像(单一属主:#153 搬家后本文件是 server 侧唯一副本;
+ *  task-settings 的旧副本随 settings 折叠臂一并拆除)。tightenTaskSpec 的契约是「override 自身必须收紧」
+ *  而非「取两者较严」——低于 base 的 override 直接 throw,所以施加前要按 rank 只升不降。 */
+const SHELL_GATE_RANK = { off: 0, classify: 1, always: 2 };
 /**
- * Apply the operator's runtime governance (autonomy + commandPolicy) onto a base `TaskSpec`, TIGHTEN-ONLY, in a
- * SINGLE {@link tightenTaskSpec} call: commandPolicy compiles to a `toolPolicy` override (combined onto the
- * baseline by `tightenTaskSpec` — TRAP #1), and autonomy expands to `handsReadOnly` / `shellGate` overrides
- * (TRAP #2). `tightenTaskSpec` THROWS `TaskSpecTightenError` if any override would LOOSEN a stricter base safety
- * field — surfacing a misconfiguration loudly instead of silently weakening the gate. Returns `base` untouched
- * when there is nothing to apply (no autonomy override and no commandPolicy).
+ * Apply the operator's runtime governance (autonomy + commandPolicy + manualModeShellGate) onto a base
+ * `TaskSpec`, TIGHTEN-ONLY, in a SINGLE {@link tightenTaskSpec} call: commandPolicy compiles to a `toolPolicy`
+ * override (combined onto the baseline by `tightenTaskSpec` — TRAP #1), and autonomy expands to
+ * `handsReadOnly` / `shellGate` overrides (TRAP #2). `tightenTaskSpec` THROWS `TaskSpecTightenError` if any
+ * override would LOOSEN a stricter base safety field — surfacing a misconfiguration loudly instead of silently
+ * weakening the gate. Returns `base` untouched when there is nothing to apply.
+ *
+ * #153([2713] server 分单②):`MANUAL_MODE_SHELL_GATE` 从 settings 折叠搬到这里**无条件施加**。旧家
+ * (task-settings deriveSettingsPolicy 的 default/auto/acceptEdits 三臂)让一个**部署级 tighten-only 旋钮
+ * 的生死由客户端表态在场性决定**:body 无 settings/permissionMode(cli print/headless 腿按设计不 stamp)
+ * ⇒ 旋钮静默失效(clay 实机 Monitor 案「门根本没铸」);bypassPermissions 一句话掀掉部署闸;非 host lane
+ * fsWriteGate wiring 不建 ⇒ 沙箱 lane 全失效。governance 层与 autonomy 同拍施加后三者全闭。rank 合成:
+ * autonomy 派生值与旋钮取大(ask→"always" 压过 "classify"),再对 base 只升不降(防 tightenTaskSpec throw)。
  */
 export function applyRuntimeGovernance(base, governance) {
     const overrides = { ...autonomyOverrides(governance.autonomy) };
     const coarse = compileCommandPolicy(governance.commandPolicy);
     if (coarse)
         overrides.toolPolicy = coarse;
+    if (governance.manualModeShellGate !== undefined) {
+        const candidate = overrides.shellGate !== undefined && SHELL_GATE_RANK[overrides.shellGate] >= SHELL_GATE_RANK[governance.manualModeShellGate]
+            ? overrides.shellGate
+            : governance.manualModeShellGate;
+        // base 已更严(如 resume 重放时 base 带 always)⇒ 省略,让 base 原样保留(省略=行为等价,不 throw)。
+        if (SHELL_GATE_RANK[candidate] >= SHELL_GATE_RANK[base.shellGate ?? "off"])
+            overrides.shellGate = candidate;
+        else
+            delete overrides.shellGate;
+    }
     if (overrides.toolPolicy === undefined && overrides.handsReadOnly === undefined && overrides.shellGate === undefined) {
         return base; // nothing to govern → avoid a needless tightenTaskSpec pass
     }

package/dist/task-settings.d.ts

@@ -181,19 +181,21 @@ export interface FsWriteGateWiring {
      *  now closed). Source = config `SENSITIVE_WRITE_PATTERNS` (unset ⇒ core RECOMMENDED_SENSITIVE_PATTERNS; the
      *  set curation is core's — the server passes through). Absent/empty ⇒ no sensitive policy (pre-1.295 shape). */
     sensitivePatterns?: string[];
-    /** [1557]§四 opt-in(cli[1555]②「echo -n … > file 绕写门」缺口的部署侧补丁,core[1556] 建议):
-     *  CC manual 系模式(default/auto/acceptEdits — 见 {@link deriveSettingsPolicy})額外把
-     *  `TaskSpec.shellGate` 收紧到这个值,让 Bash 走同一 fs-write 审批链(core `bashReversibilityProbe`
-     *  在 `"classify"` 下只拦构造性不可逆命令——含 shell 重定向 `>`/`>>` 等,纯读命令白名单自动放行)。
-     *  **Absent(缺省)= 零行为变化**(config `MANUAL_MODE_SHELL_GATE` 未设置时不传本字段,pre-此批行为
-     *  byte-for-byte;这是个 tighten-only opt-in,不是默认开启——运营方需要显式选择开启)。 */
-    shellGate?: "always" | "classify";
 }
 export declare function deriveSettingsPolicy(settings: ParsedTaskSettings, gate?: FsWriteGateWiring, workflowGate?: WorkflowGateWiring): {
     toolPolicy?: ToolPolicy;
     handsReadOnly?: boolean;
     enablePlanMode?: boolean;
-    shellGate?: "always" | "classify";
 };
+/**
+ * Apply a client's parsed per-request settings onto a base `TaskSpec`, TIGHTEN-ONLY, in a SINGLE {@link
+ * tightenTaskSpec} pass (so the permission override composes deny-wins onto the baseline — TRAP #1 — and
+ * `handsReadOnly`/`onAsk` can only narrow). `tightenTaskSpec` THROWS `TaskSpecTightenError` if any override would
+ * LOOSEN a stricter base — surfaced by the caller as a 4xx (a client settings stamp that tries to widen is a
+ * client error, never a silent weakening). `model`/`outputStyle` are applied directly (model is the caller's
+ * choice WITHIN the catalog — the caller gates it before calling; outputStyle appends to the system prompt).
+ *
+ * Returns `base` untouched when the parsed settings project nothing onto the spec.
+ */
 export declare function applyTaskSettings(base: TaskSpec, settings: ParsedTaskSettings, gate?: FsWriteGateWiring, workflowGate?: WorkflowGateWiring): TaskSpec;
 //# sourceMappingURL=task-settings.d.ts.map

package/dist/task-settings.js

@@ -426,18 +426,16 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
             return { toolPolicy: compose(createWorkflowPlanDenyPolicy()), handsReadOnly: true, enablePlanMode: true };
         case "acceptEdits": {
             const p = compose(fsWriteGate(true), createWorkflowAskPolicy(workflowGate?.isExempt));
-            return { ...(p ? { toolPolicy: p } : {}), ...(gate?.shellGate ? { shellGate: gate.shellGate } : {}) };
+            return p ? { toolPolicy: p } : {};
         }
         case "default":
         case "auto": {
             // (historical note kept: the pre-[816] impl fell through to base-only here — with no gate to attach,
             // acceptEdits-as-loosen could not be honored. The [820] factory inverts the frame: default now ADDS an ask
             // gate and acceptEdits ADDS a narrower one, both tighten-safe under the deny-wins fold.)
-            // [1557]§四: gate.shellGate opt-in(absent = pre-此批行为 byte-for-byte)rides alongside the fs-write ask
-            // gate on the SAME "CC manual" modes — closes the "echo > file bypasses the write gate" hole (cli[1555]②)
-            // when the deployment explicitly opts in (config MANUAL_MODE_SHELL_GATE).
+            // ([1557]§四 的 shellGate 便车已随 #153 搬 governance 层——见 FsWriteGateWiring 尾注。)
             const p = compose(fsWriteGate(false), createWorkflowAskPolicy(workflowGate?.isExempt));
-            return { ...(p ? { toolPolicy: p } : {}), ...(gate?.shellGate ? { shellGate: gate.shellGate } : {}) };
+            return p ? { toolPolicy: p } : {};
         }
         case "bypassPermissions":
         case undefined:
@@ -454,27 +452,17 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
  *
  * Returns `base` untouched when the parsed settings project nothing onto the spec.
  */
-// [1557]§四: core's tightenTaskSpec THROWS TaskSpecTightenError when an override's shellGate ranks LOWER than
-// base's (its contract is "the override must itself tighten", not "take the stricter of the two" — unlike
-// handsReadOnly, which ORs). Red-first repro: tightenTaskSpec({shellGate:"always"}, {shellGate:"classify"})
-// throws — so a deployment that layers autonomy=ask (→"always") UNDER this opt-in (→"classify") would 422
-// EVERY request on that mode. Mirrors core's own SHELL_GATE_RANK (tighten-task-spec.js) — only pass the
-// override through when it would not be a downgrade; otherwise the baseline already covers it (tightenTaskSpec's
-// base-only branch keeps `base.shellGate` unchanged either way — omitting is behaviorally identical, never a
-// silent weakening, just avoids the throw).
-const SHELL_GATE_RANK = { off: 0, classify: 1, always: 2 };
+// ([1557]§四 的 SHELL_GATE_RANK 副本与 shellGateSafe 守卫已随 #153 搬 runtime-governance ——
+// settings 折叠不再触碰 TaskSpec.shellGate,base 上 governance 层施加的值原样透传。)
 export function applyTaskSettings(base, settings, gate, workflowGate) {
-    const { toolPolicy, handsReadOnly, enablePlanMode, shellGate } = deriveSettingsPolicy(settings, gate, workflowGate);
-    const shellGateSafe = shellGate !== undefined && SHELL_GATE_RANK[shellGate] >= SHELL_GATE_RANK[base.shellGate ?? "off"] ? shellGate : undefined;
+    const { toolPolicy, handsReadOnly, enablePlanMode } = deriveSettingsPolicy(settings, gate, workflowGate);
     let next = base;
-    if (toolPolicy !== undefined || handsReadOnly !== undefined || shellGateSafe !== undefined) {
+    if (toolPolicy !== undefined || handsReadOnly !== undefined) {
         const overrides = {};
         if (toolPolicy !== undefined)
             overrides.toolPolicy = toolPolicy;
         if (handsReadOnly !== undefined)
             overrides.handsReadOnly = handsReadOnly;
-        if (shellGateSafe !== undefined)
-            overrides.shellGate = shellGateSafe; // [1557]§四 opt-in; rank-guarded above
         next = tightenTaskSpec(next, overrides); // deny-wins compose + THROWS on loosen (fail-loud)
     }
     // R4: enablePlanMode (mount present_plan) is ADDITIVE — it widens NOTHING (a read-only plan workflow), so it rides

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.0.0",
+  "version": "7.1.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -68,7 +68,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^6.5.0",
+    "@sema-agent/sdk": "^6.6.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",