@sema-agent/server 7.104.0 → 7.105.0

package/dist/observability/run-terminal.js

@@ -97,28 +97,72 @@ export function redactModelText(raw) {
         return OVERSIZED_REDACTION_PLACEHOLDER;
     }
 }
+const PROVIDER_ECHO_SHAPE = /^[\x21-\x7E]{1,128}$/;
+function isProviderEchoShape(value) {
+    return PROVIDER_ECHO_SHAPE.test(value);
+}
+export function admitProviderEcho(value, seat) {
+    if (value === undefined)
+        return false;
+    if (typeof value === "string" && isProviderEchoShape(value))
+        return true;
+    const what = typeof value === "string" ? `len=${value.length}` : `type=${value === null ? "null" : typeof value}`;
+    recordFailOpen("server.run-terminal.provider-echo-shaped", `seat=${seat} ${what}`);
+    return false;
+}
+function shapeEchoMembers(node, table, seat) {
+    if (node === null || typeof node !== "object" || Array.isArray(node))
+        return node;
+    const n = node;
+    let out;
+    for (const [key, treatment] of Object.entries(table)) {
+        const v = n[key];
+        if (v === undefined)
+            continue;
+        switch (treatment) {
+            case "verbatim":
+            case "provider-join-key":
+                break;
+            case "provider-echo":
+                if (!admitProviderEcho(v, `${seat}.${key}`))
+                    delete (out ??= { ...n })[key];
+                break;
+            default: {
+                const unhandled = treatment;
+                throw new Error(`unhandled echo-member treatment: ${String(unhandled)}`);
+            }
+        }
+    }
+    return out ?? node;
+}
+function shapeEchoRows(rows, table, seat) {
+    if (!Array.isArray(rows))
+        return rows;
+    const next = rows.map((row) => shapeEchoMembers(row, table, seat));
+    return next.every((x, i) => x === rows[i]) ? rows : next;
+}
 const MAX_EDITED_FILES = 1000;
 const RESULT_KEY_TREATMENT = {
     terminal: "redacted",
     remoteEnvFailures: "redacted",
     editedFiles: "redacted",
+    responseModel: "provider-echo",
+    apiFailure: "provider-echo",
+    strandedHumanAnswers: "provider-echo",
     taskId: "verbatim",
     runId: "verbatim",
     sessionId: "verbatim",
     model: "verbatim",
-    responseModel: "verbatim",
     compaction: "verbatim",
     effectiveReasoning: "verbatim",
     result: "redacted",
     salvagedOutput: "redacted",
-    apiFailure: "verbatim",
     retryAfterMs: "verbatim",
     degraded: "verbatim",
     structuredOutput: "verbatim",
     rewindNotes: "redacted",
     haltedOnUserRejection: "verbatim",
     haltedByUser: "verbatim",
-    strandedHumanAnswers: "verbatim",
     pendingApproval: "verbatim",
     approvalWaitedMs: "verbatim",
     effectiveReadFace: "verbatim",
@@ -127,9 +171,28 @@ const RESULT_KEY_TREATMENT = {
     effectiveMemoryScopes: "verbatim",
     stats: "redacted",
 };
+const API_FAILURE_TREATMENT = {
+    status: "verbatim",
+    requestId: "provider-echo",
+};
+const STRANDED_ANSWER_TREATMENT = {
+    deliveryId: "verbatim",
+    toolCallId: "provider-join-key",
+};
+const PROVIDER_ECHO_SHAPERS = {
+    responseModel: (v) => (admitProviderEcho(v, "responseModel") ? v : undefined),
+    apiFailure: (v) => shapeEchoMembers(v, API_FAILURE_TREATMENT, "apiFailure"),
+    strandedHumanAnswers: (v) => shapeEchoRows(v, STRANDED_ANSWER_TREATMENT, "strandedHumanAnswers[]"),
+};
+{
+    const judged = Object.entries(RESULT_KEY_TREATMENT).filter(([, t]) => t === "provider-echo").map(([k]) => k).sort();
+    const wired = Object.keys(PROVIDER_ECHO_SHAPERS).sort();
+    if (judged.join(",") !== wired.join(","))
+        throw new Error(`run-terminal: provider-echo classification [${judged.join(",")}] ≠ shaper table [${wired.join(",")}]`);
+}
 const LEGACY_RESULT_LEAVES = ["errorMessage", "blockedReason", "checkpointGate"];
-export const REDACTABLE_RESULT_LEAVES = [
-    ...Object.entries(RESULT_KEY_TREATMENT).filter(([, t]) => t === "redacted").map(([k]) => k),
+export const TREATED_RESULT_LEAVES = [
+    ...Object.entries(RESULT_KEY_TREATMENT).filter(([, t]) => t !== "verbatim").map(([k]) => k),
     ...LEGACY_RESULT_LEAVES,
 ];
 export function redactTerminalResult(result) {
@@ -235,6 +298,20 @@ export function redactTerminalResult(result) {
             changed = true;
         }
     }
+    const rr = result;
+    for (const [key, shape] of Object.entries(PROVIDER_ECHO_SHAPERS)) {
+        const v = rr[key];
+        if (v === undefined || shape === undefined)
+            continue;
+        const next = shape(v);
+        if (next === v)
+            continue;
+        if (next === undefined)
+            delete out[key];
+        else
+            out[key] = next;
+        changed = true;
+    }
     return changed ? out : result;
 }
 export function sealRunRowResult(result) {
@@ -267,8 +344,18 @@ export function redactLedgerEventData(type, data) {
         const next = redactCheckpointGate(gate);
         return next === gate ? data : { ...data, gate: next };
     }
+    if (type === "turn_end")
+        return shapeEchoMembers(data, TURN_END_ECHO_TREATMENT, "turn_end");
+    if (type === "task_notification") {
+        const af = data.apiFailure;
+        if (af === undefined)
+            return data;
+        const next = shapeEchoMembers(af, API_FAILURE_TREATMENT, "task_notification.apiFailure");
+        return next === af ? data : { ...data, apiFailure: next };
+    }
     return data;
 }
+const TURN_END_ECHO_TREATMENT = { responseModel: "provider-echo" };
 export function redactWorkerReportError(report) {
     const gate = redactCheckpointGate(report.checkpointGate);
     const error = report.error === undefined ? undefined : (redactErrorMessage(report.error) ?? "");
@@ -389,7 +476,7 @@ const STATS_GATE_ROW_TREATMENT = {
     decision: "verbatim",
     toolName: "verbatim",
     toolArg: "model-text",
-    toolCallId: "verbatim",
+    toolCallId: "provider-join-key",
 };
 const STATS_REPETITION_EVENT_TREATMENT = {
     turn: "verbatim",
@@ -420,6 +507,8 @@ function redactStatsNode(node, table) {
         switch (treatment) {
             case "verbatim":
                 break;
+            case "provider-join-key":
+                break;
             case "model-text":
                 if (typeof v === "string")
                     next = redactModelText(v);
@@ -674,15 +763,32 @@ export function memoRedactTerminalResult(seat, result) {
     if (result === undefined || result === null)
         return result;
     const r = result;
-    if (REDACTABLE_RESULT_LEAVES.every((k) => r[k] === undefined))
+    if (TREATED_RESULT_LEAVES.every((k) => r[k] === undefined))
         return result;
     const leaves = {};
-    for (const k of REDACTABLE_RESULT_LEAVES)
+    for (const k of TREATED_RESULT_LEAVES)
         leaves[k] = r[k];
     const redacted = memoRedactedRead(seat, leaves, (l) => redactTerminalResult(l));
     if (redacted === leaves)
         return result;
-    return { ...result, ...redacted };
+    const merged = { ...result, ...redacted };
+    for (const k of TREATED_RESULT_LEAVES)
+        if (!Object.hasOwn(redacted, k))
+            delete merged[k];
+    return merged;
+}
+export function redactLedgerEventForRead(type, data) {
+    if (type === "done" && data !== null && typeof data === "object") {
+        const result = data.result;
+        if (result && typeof result === "object") {
+            return { ...data, result: memoRedactTerminalResult("ev.done.result", result) };
+        }
+    }
+    if (type === "failed")
+        return memoRedactedRead("ev.failed", data, (d) => redactLedgerEventData(type, d));
+    if (isModelTextLedgerEventType(type))
+        return memoRedactedRead("ev.model-text", data, (d) => redactLedgerEventData(type, d));
+    return redactLedgerEventData(type, data);
 }
 let shadowScans = 0;
 export function diffScanShadowCountForTest() { return shadowScans; }

package/dist/plugins/image-bake-store-sql.d.ts

@@ -122,8 +122,6 @@ export declare class SqlImageBake {
     private lineOrdExists;
     /** Highest event seq for a bake (0 if none) — the ++seq allocator + the resume cursor head. */
     maxSeq(bakeId: string): Promise<number>;
-    /** Earliest retained event seq (0 if none) → the SSE 416 boundary (a resume below this was evicted, P2.9). */
-    retainedFrom(bakeId: string): Promise<number>;
     /** Events with seq strictly greater than `afterSeq` (0 for the whole stream), ascending. */
     getEvents(bakeId: string, afterSeq: number): Promise<BakeEvent[]>;
     /**

package/dist/plugins/image-bake-store-sql.js

@@ -379,11 +379,6 @@ export class SqlImageBake {
         const m = rows[0]?.m;
         return m == null ? 0 : Number(m);
     }
-    async retainedFrom(bakeId) {
-        const { rows } = await this.db.query(this.q("SELECT MIN(seq) AS m FROM image_bake_event WHERE bake_id = ?", "SELECT MIN(seq) AS m FROM image_bake_event WHERE bake_id = $1"), [bakeId]);
-        const m = rows[0]?.m;
-        return m == null ? 0 : Number(m);
-    }
     async getEvents(bakeId, afterSeq) {
         const { rows } = await this.db.query(this.q(`SELECT seq, line_ord, kind, level, ${jsonColumnText("tidb", "data")}, ts FROM image_bake_event WHERE bake_id = ? AND seq > ? ORDER BY seq ASC`, `SELECT seq, line_ord, kind, level, ${jsonColumnText("pg", "data")}, ts FROM image_bake_event WHERE bake_id = $1 AND seq > $2 ORDER BY seq ASC`), [bakeId, afterSeq]);
         return rows.map((r) => ({

package/dist/plugins/retention-store-sql.js

@@ -380,6 +380,7 @@ export class SqlRetentionStore {
             ["resume_anchor", "session_id"],
             ["approval_exemption", "session_id"],
             ["session_policy", "session_id"],
+            ["session_policy_rev_mark", "session_id"],
             ...(this.opts.taskAttachmentTable ? [["task_attachment", "session_id"]] : []),
             ["file_history_tracked", "scope"],
             ["file_history_version", "scope"],

package/dist/plugins/run-store-sql.d.ts

@@ -248,8 +248,9 @@ export declare class SqlRunStore {
         rows: UsageRow[];
         truncated: boolean;
     }>;
-    /** Earliest retained event seq for a task (0 if none) → `retainedFrom` for /turns and the 416 boundary for
-     *  /stream (a resume point below this has been evicted past retention). */
+    /** Earliest retained event seq for a task (0 if none) → the `retainedFrom` field of `GET /v1/tasks/:id/turns`.
+     *  Not an eviction boundary: the ledger has no partial head trim (the only deletion takes the whole session tree),
+     *  so a value > 1 means head rows whose write failed after consuming their seq (S-211 ①). */
     retainedFrom(taskId: string): Promise<number>;
     /** Events with seq strictly greater than `afterSeq` (use 0 for the whole stream). */
     getEvents(taskId: string, afterSeq: number): Promise<RunEvent[]>;

package/dist/plugins/schema-indexes.js

@@ -10,6 +10,7 @@ export const CENTRAL_SCHEMA_INDEXES = [
     { table: "approval_nonce", name: "idx_approval_nonce_expires", columns: ["expires_at_ms"] },
     { table: "sendfile_link", name: "idx_sendfile_link_scope", columns: ["scope", "id"] },
     { table: "session_policy", name: "idx_session_policy_session", columns: ["session_id"] },
+    { table: "session_policy_rev_mark", name: "idx_session_policy_rev_mark_session", columns: ["session_id"] },
     { table: "snapshot_blob", name: "idx_snapshot_blob_created", columns: ["created_at"] },
     { table: "file_history_version", name: "idx_file_history_version_blob", columns: ["blob_hash"] },
     { table: "file_history_boundary_file", name: "idx_file_history_bf_key", columns: ["scope", "key_hash"] },

package/dist/plugins/session-policy-store-sql.js

@@ -22,18 +22,21 @@ function readRulesBody(text, where) {
         throw new SessionPolicyError("corrupt", `${e.message} — an unreadable rules body served as an EMPTY rule set would silently drop every tightening this session carries`);
     }
 }
+function isStoredCounter(n, floor) {
+    return Number.isSafeInteger(n) && n >= floor;
+}
 function rowToStored(r, where) {
     const rev = Number(r.rev);
-    if (!Number.isFinite(rev) || !Number.isInteger(rev) || rev < 1) {
-        throw new SessionPolicyError("corrupt", `session rules row ${where} carries rev ${String(r.rev)} — a stored row's rev is always ≥ 1 (the stamp is floor+1), and rev 0 is the live reader's synthetic empty seed; refusing rather than serve it as rules`);
+    if (!isStoredCounter(rev, 1)) {
+        throw new SessionPolicyError("corrupt", `session rules row ${where} carries rev ${String(r.rev)} — a stored row's rev is always a whole number ≥ 1 within the safe-integer range (the stamp is floor+1), and rev 0 is the live reader's synthetic empty seed; refusing rather than serve it as rules`);
     }
     if (r.gen === undefined || r.gen === null) {
         throw new Error(`session_policy row ${where} came back without a \`gen\` column — a read leg did not project it (the column is BIGINT NOT NULL on both dialects). ` +
             "Refusing rather than judge this row's lineage as generation 0, which is a value nothing minted.");
     }
     const gen = Number(r.gen);
-    if (!Number.isFinite(gen) || !Number.isInteger(gen) || gen < 0) {
-        throw new SessionPolicyError("corrupt", `session rules row ${where} carries lineage gen ${String(r.gen)} — a generation is a whole number ≥ 0; refusing rather than let a reader judge lineage by a value nothing minted`);
+    if (!isStoredCounter(gen, 0)) {
+        throw new SessionPolicyError("corrupt", `session rules row ${where} carries lineage gen ${String(r.gen)} — a generation is a whole number ≥ 0 within the safe-integer range; refusing rather than let a reader judge lineage by a value nothing minted`);
     }
     return { ...readRulesBody(r.rules, `session_policy.rules ${where}`), rev, gen };
 }
@@ -73,7 +76,7 @@ export class SqlSessionPolicyStore {
             const { rows: markRows } = await conn.query(this.q("SELECT rev, gen FROM session_policy_rev_mark WHERE policy_key = ? FOR UPDATE", "SELECT rev, gen FROM session_policy_rev_mark WHERE policy_key = $1 FOR UPDATE"), [key]);
             const markRev = markRows[0] ? Number(markRows[0].rev) : 0;
             const markGen = markRows[0] ? Number(markRows[0].gen) : 0;
-            if (markRows[0] !== undefined && (!Number.isInteger(markGen) || markGen < 0 || !Number.isFinite(markRev) || markRev < 0)) {
+            if (markRows[0] !== undefined && (!isStoredCounter(markGen, 0) || !isStoredCounter(markRev, 0))) {
                 throw new SessionPolicyError("corrupt", `the session rules rev mark for session ${JSON.stringify(sessionId)} is unreadable (rev ${String(markRows[0].rev)}, gen ${String(markRows[0].gen)}) — refusing rather than stamp a rev/lineage nothing proves`);
             }
             const clean = normalizeRules(stripRev(rules));
@@ -88,6 +91,9 @@ export class SqlSessionPolicyStore {
             }
             const nextRev = Math.max(priorRev, markRev) + 1;
             const nextGen = prior?.gen ?? markGen;
+            if (!isStoredCounter(nextRev, 1) || !isStoredCounter(nextGen, 0)) {
+                throw new SessionPolicyError("corrupt", `session rules for session ${JSON.stringify(sessionId)}: the next stamp (rev ${nextRev}, gen ${nextGen}) would leave the safe-integer range this store reads back — refusing before writing a row nothing could read`);
+            }
             const json = JSON.stringify(clean);
             const now = new Date();
             if (prior) {
@@ -121,6 +127,13 @@ export class SqlSessionPolicyStore {
             const now = new Date();
             const keys = rows.map((r) => String(r.policy_key));
             const params = [];
+            for (const r of rows) {
+                const rev = Number(r.rev);
+                const nextGen = Number(r.gen ?? 0) + 1;
+                if (!isStoredCounter(rev, 1) || !isStoredCounter(nextGen, 0)) {
+                    throw new SessionPolicyError("corrupt", `session rules row for session ${JSON.stringify(sessionId)} carries rev ${String(r.rev)} / gen ${String(r.gen)} — the erase would leave a mark outside the safe-integer range; refusing before writing it`);
+                }
+            }
             const tuples = rows.map((r) => {
                 params.push(String(r.policy_key), sessionId, Number(r.rev), Number(r.gen ?? 0) + 1, now);
                 const base = params.length - 5;

package/dist/plugins/store-backend.d.ts

@@ -44,9 +44,11 @@ export type { ApprovalNonceStore } from "./approval-nonce-store.js";
 /** [ref]([ref] v3.1 §3.0-§3.2 流内审批协议持久层):`ApprovalAskStore` 接口 + 行/补丁类型。
  *  车3 刀 3a 起 `StoreBackend.approvalAsk()` 已在(见接口体的那条注)。 */
 export type { ApprovalAskStore, AskRow, NewAskRow, AskTransitionPatch, DecideAskInput, DecideResult, ExpireResult, BindGateInput, BatchRow, AskDecision } from "./approval-ask-store-sql.js";
-/** E6 SessionPolicyStore — core's interface PLUS the service `deleteBySession` (E21 purge; only the durable twins carry
- *  it, core's InMemory omits it → optional). tidb/pg = durable twins; local = core's InMemorySessionPolicyStore (works
- *  local — rules need no cloud-only infra). The shared env-gated equivalence suite keeps the twins byte-matched to InMemory. */
+/** E6 SessionPolicyStore — core's interface, incl. its optional `deleteBySession` / `listBySession` seams (E21 purge / 2c
+ *  export; core's File and InMemory stores carry both since core 7.25.0 — S-546 A7 retired the service's own in-memory
+ *  twin that existed only because they once did not). tidb/pg = the SQL twin; local = core's FileSessionPolicyStore
+ *  (works local — rules need no cloud-only infra). The rev-line contract kit runs the SQL twin against core's InMemory
+ *  as oracle (`test/helpers/session-policy-rev-line-contract.ts`). */
 export type ServiceSessionPolicyStore = SessionPolicyStore;
 /** [ref] per-edited-file rewind FileHistoryStore — core's interface PLUS the service extras only the SQL twins
  *  carry (optional so the local lane's core `FileFileHistoryStore` still fits). Replaces the retired E19
@@ -192,7 +194,7 @@ export interface StoreBackend {
      *  mapping from URLs). REQUIRED on all backends (works local — one JSONL, like approvalExemption). */
     sendFileLedger(): SendFileLedger;
     /** E6 durable SessionPolicyStore (operator-tightened per-session tool rules). REQUIRED on all backends — works local
-     *  (local = core's InMemorySessionPolicyStore), like resumeAnchor. Backs core's RunnerDeps.sessionPolicyStore. */
+     *  (local = core's FileSessionPolicyStore), like resumeAnchor. Backs core's RunnerDeps.sessionPolicyStore. */
     sessionPolicy(): ServiceSessionPolicyStore;
     /** [ref] per-edited-file rewind FileHistoryStore (trackEdit/annulTrack/snapshot/restore over the tracked set;
      *  also the 2c history-transfer store). REQUIRED on all backends (local = core's file-backed

package/dist/plugins/tidb-pool.js

@@ -387,8 +387,8 @@ export const SCHEMA_STATEMENTS = [
    ) COLLATE utf8mb4_bin`,
     `CREATE TABLE IF NOT EXISTS session_policy_rev_mark (
      policy_key CHAR(64)     NOT NULL,
-     -- 被删会话。记号的读写一律按 policy_key 单键;这一列是**运维可读性 + 未来按会话/按龄回收**的那条腿
-     -- 的抓手(今天没有任何生产查询按它选行 —— 留存腿与收编腿都不碰本表,理由见上面那段)。
+     -- 被删会话(**明文**会话 id —— 所以它必须随会话一起走,见上)。记号的读写按 policy_key 单键;托管留存的整树
+     -- 清扫按本列删(S-546 A9,索引 idx_session_policy_rev_mark_session)。
      session_id VARCHAR(64)  NOT NULL,
      -- 抹除时刻该键带过的最高 rev(GREATEST 合并:记号只升不降)。
      rev        BIGINT       NOT NULL,
@@ -397,7 +397,8 @@ export const SCHEMA_STATEMENTS = [
      -- DEFAULT 0 = 本列到货前落下的记号(那些键的行也都是第 0 代 ⇒ 下一次抹除把它们抬到 1,前后自洽)。
      gen        BIGINT       NOT NULL DEFAULT 0,
      erased_at  DATETIME(3)  NOT NULL,
-     PRIMARY KEY (policy_key)
+     PRIMARY KEY (policy_key),
+     KEY idx_session_policy_rev_mark_session (session_id)
    ) COLLATE utf8mb4_bin`,
     `CREATE TABLE IF NOT EXISTS snapshot_blob (
      blob_hash  CHAR(64)    NOT NULL,

package/dist/read-face-posture.d.ts

@@ -65,4 +65,25 @@ export declare function buildReadFaceWiring(facts: ReadFacePostureFacts): {
     source: ReadFaceSource;
     note: string;
 };
+/**
+ * S-176 —— posture 派生的档位在 **boot 期推送面**的那一行(`config.ts` 经既有 `CONFIG_NOTICES` 以 info 级排空)。
+ *
+ * 为什么要有:S-167 的补偿项是「升级即放开,得让运维看得见并知道怎么钉回」,可此前唯一看得见的是**拉取**面
+ * (`GET /v1/diagnostics/wiring`)—— 只对会去拉的人成立。单机 boot 日志里零字。
+ * 为什么只在 `posture` 一词上说:另外三词都不是「没人表态、服务替它选了一个更宽的档」——`env` 是运维自己写的,
+ * `engine-default` 是本服务没铸(引擎默认接管),`center` 在 boot 这一拍还没到货(它有自己的换席通告)。
+ * 为什么是 info 不是 warn:每一台照常配置的单机每次启动都成立,是常态事实不是异常(与执行车道落点同级)。
+ *
+ * 字段与极性表的 posture 行同名(`knob` / `value` / `source`),另带指路句;三格由 {@link buildReadFaceWiring} 投影出 ——
+ * 拉取面与推送面**同一只函数**,不各算一次。`value` 是字符串:只有 `face` 在场的那一形才会走到这里。
+ */
+export declare function buildReadFacePostureNotice(facts: ReadFacePostureFacts): {
+    event: "config_knob_posture_derived";
+    fields: {
+        knob: "READ_FACE";
+        value: string;
+        source: ReadFaceSource;
+        note: string;
+    };
+} | undefined;
 //# sourceMappingURL=read-face-posture.d.ts.map

package/dist/read-face-posture.js

@@ -14,4 +14,13 @@ export function readFaceSourceNote(source) {
 export function buildReadFaceWiring(facts) {
     return { face: facts.readFace ?? null, source: facts.readFaceSource, note: readFaceSourceNote(facts.readFaceSource) };
 }
+export function buildReadFacePostureNotice(facts) {
+    if (facts.readFaceSource !== "posture")
+        return undefined;
+    const wiring = buildReadFaceWiring(facts);
+    if (wiring.face === null) {
+        throw new Error("read-face posture notice: source is `posture` but no face was minted — readFaceForPosture's invariant broke");
+    }
+    return { event: "config_knob_posture_derived", fields: { knob: "READ_FACE", value: wiring.face, source: wiring.source, note: wiring.note } };
+}
 //# sourceMappingURL=read-face-posture.js.map

package/dist/rules-consent.js

@@ -736,17 +736,6 @@ export function createRuleConsentLane(stores, opts) {
                 adds: [],
             };
             const rowOf = (rows) => rows.find((r) => sameWireRuleIdentity(r, { behavior: input.behavior, rule: written.rule.rule, scope: row.scope }));
-            let before;
-            try {
-                before = await lane.listRules(input.principal);
-            }
-            catch (e) {
-                localImportLogger.warn("direct_rule_write_pre_read_failed", { behavior: input.behavior, err: e instanceof Error ? e.message : String(e) });
-                return { status: "failed", detail: `the rule store could not be read before writing: ${e instanceof Error ? e.message : String(e)}`, committed: "no" };
-            }
-            const standing = rowOf(before.rows);
-            if (standing !== undefined)
-                return { status: "no-op", rev: before.rev, stillLive: "yes", row: standing };
             const screened = screenLocalImportRow(row);
             if ("reason" in screened)
                 return { status: "rejected", reason: screened.reason, detail: screened.detail };

package/dist/session-policy-wire.d.ts

@@ -16,10 +16,16 @@
  *        自陈「Malformed shape → 400(never a downstream TypeError)」,这一半没守);
  *      · `loosenReasons` 的每一臂都从 `prior` 出发,**prior 为空时恒回空集** ⇒ tighten-only 门对一条
  *        全新的会话放行任何内容,坏形因此连「收紧门」这一层都碰不到。
- * ⇒ 类修:一只读者,键集由 `keyof SessionPermissionRules` **派生**(下方 `RULE_FIELD_PRESENCE` 的
- * `satisfies Record<keyof SessionPermissionRules, true>`:core 加桶 ⇒ 缺键**编译红**;core 删桶 ⇒
+ * ⇒ 类修:一只读者,键集由 `keyof SessionPermissionRules` **派生**(下方 `RULE_FIELD_ROLE` 的
+ * `satisfies Record<keyof SessionPermissionRules, RuleFieldRole>`:core 加桶 ⇒ 缺键**编译红**;core 删桶 ⇒
  * 多键**编译红**),两条腿同调。
  *
+ * ── S-800(7.105.0):同一只读者多判一问 —— 写得进却跑不了的工具名 ─────────────────────────────────
+ * 两条写入腿是 server 往会话规则店写的**全部**写口,所以「写口 fail-closed」收成一只**写口读者**
+ * ({@link readWritableSessionPermissionRules} = 形读者 + {@link legacyToolNameOf}),两腿同调,将来第三条写入腿
+ * 调同一只也同得。判词多一种(`legacy-tool-name`),两腿各把它映射成 `400 rules.legacy_tool_name`(映射点仍在各自
+ * 站点:码位只放字面量)。形读者本身不变 —— SQL 店的读回也用它,读回不许判名字(理由见写口读者头注)。
+ *
  * ── 文案也在这里(codex 一轮追加:两条腿各铸一份句子 = 第二份手抄)───────────────────────────────
  * 初版把 wire 文案留在两个路由各自铸,理由是错误文案冻结门(`test/api-error-text-freeze.test.ts`)锚的是
  * `src/http/` 桶里的 `sendError` 站点。codex 一轮指出那等于**把同一句话写了两遍**(`sessions.ts` 与
@@ -28,10 +34,52 @@
  * 渲染器对每一种判词的输出字节,且对判词闭集穷尽(加一种判词 ⇒ 那一格编译红)。文案一个字节未改。
  */
 import type { SessionPermissionRules, SessionPolicyError, SessionRulesRecord } from "@sema-agent/core";
+declare const RULE_FIELD_ROLE: {
+    readonly toolAllow: "tool-name";
+    readonly toolDeny: "tool-name";
+    readonly allowDirs: "path";
+    readonly commandAllow: "command";
+    readonly commandDeny: "command";
+};
 /** core `SessionPermissionRules` 的桶名全集(派生,不是手抄)。 */
 export declare const SESSION_PERMISSION_RULE_FIELDS: readonly (keyof SessionPermissionRules)[];
-/** 一条规则体的形问题。判词而非文案(见文件头注的「文案属主」一段)。 */
-export type SessionPermissionRulesProblem = 
+/** 装工具名的那几桶(由 {@link RULE_FIELD_ROLE} 派生的型)。 */
+export type ToolNameRuleField = {
+    [K in keyof typeof RULE_FIELD_ROLE]: (typeof RULE_FIELD_ROLE)[K] extends "tool-name" ? K : never;
+}[keyof typeof RULE_FIELD_ROLE];
+/**
+ * S-800(client-core [ref] CC-226;server [ref];core [ref])—— 「写得进、跑不了、撤不掉」的工具名。
+ *
+ * 两臂,逐字对应 core 7.33.8 准备阶段名审计抛 `config.legacy_tool_name` 的那两臂(判据只用 core **导出**的
+ * 两件,零镜像表 —— 表随 core 钉版走):
+ *  · `"retired"`:名字在 core 的 `RETIRED_TOOL_NAMES` 里;`guidance` = 那张表给它的一句现役指引(原样);
+ *  · `"unprefixed-namespace"`:名字里有 `"__"` 分隔符,而 `protocolOf(name)` 认不出它属于哪个协议。
+ *
+ * 为什么在**写口**判:会话规则店只准非 operator 收紧,删掉一条 deny 算放宽 ⇒ 写进去的这种名字属主自己删不掉,
+ * 而准备阶段见它就整只拒启 ⇒ 这个会话之后的每一跑都起不来。写口是唯一还来得及说「不」的地方。
+ *
+ * ⚠️ **比准备阶段严一格**(方向安全,与 client-core 0.83.6 的 KL-157 同向):准备阶段对**本 run 名册里挂着**的
+ * 同名工具放行(部署自己挂了一只叫 `Task` 的工具就不审计它),写口看不到将来哪一跑的名册 ⇒ 一律拒。
+ * 受伤的是「部署自带与退役名同名的工具、又要在会话规则里点它」的形;出路 = 部署级工具策略(不经会话规则店)。
+ * ⚠️ **过渡形**:core 已表态(#1156,7.34.1)把这两臂抽成一只导出纯函数并在会话规则店写口即拒 —— 到货后本函数
+ * 换成调 core 那只(拒因原样透传),三份判定收成一份。
+ *
+ * 🔴 **为什么不复用 `config.ts` 的 `findUnmatchableToolNames`**(本仓另一只按名字判的单点;读过实现后裁):两只回答的
+ * 不是同一个问题。那一只问「部署名单里这条名字会不会**永远匹配不上**活工具」—— 它刻意豁免 `allow`(白名单匹配不上 =
+ * fail-closed 且当场可见),并且拒两段 MCP 名 `mcp__srv`(一名两义)与 core 文法编不出的串。本函数问的是「引擎见到这条
+ * 会话规则会不会**拒启**」:引擎准备阶段的名审计对 `allow` 桶照样抛(豁免它 = 放过一条砖化路径),对 `mcp__srv` 却
+ * **不**抛(会话层自 core 5.55 / 5.56 起把它当整对端覆盖形真命中)。判据只能逐字跟 core 那两臂走,不能借另一只的口径。
+ * 两只在「退役名」「无前缀 `__` 名」两臂上同源(都读 core 导出的同两件),7.34.1 提货时一并换调 core 的导出函数。
+ */
+export type LegacyToolName = {
+    why: "retired";
+    guidance: string;
+} | {
+    why: "unprefixed-namespace";
+};
+export declare function legacyToolNameOf(name: string): LegacyToolName | undefined;
+/** 一条规则体的**形**问题。判词而非文案(见文件头注的「文案属主」一段)。 */
+export type SessionPermissionRulesShapeProblem = 
 /** 整体不是一只普通对象(`null` / 数组 / 标量 / 缺席)。 */
 {
     kind: "not-an-object";
@@ -41,22 +89,45 @@ export type SessionPermissionRulesProblem =
     kind: "field-not-string-array";
     field: keyof SessionPermissionRules;
 };
-/** {@link readSessionPermissionRules} 的读数:坏形给判词,好形给**已收窄**的规则体(调用方零 cast)。 */
-export type SessionPermissionRulesRead = {
-    problem: SessionPermissionRulesProblem;
+/** 一条**要写进店**的规则体的问题 = 形问题 ∪ S-800 的名字问题(判据 {@link legacyToolNameOf})。 */
+export type SessionPermissionRulesProblem = SessionPermissionRulesShapeProblem
+/** S-800:形对,但工具名桶里有一条写进去就跑不了的名字。 */
+ | {
+    kind: "legacy-tool-name";
+    field: ToolNameRuleField;
+    name: string;
+    legacy: LegacyToolName;
+};
+/** 两只读者的读数:有问题给判词,没问题给**已收窄**的规则体(调用方零 cast)。`P` = 这只读者会给的判词集。 */
+export type SessionPermissionRulesRead<P extends SessionPermissionRulesProblem = SessionPermissionRulesProblem> = {
+    problem: P;
     rules?: undefined;
 } | {
     problem?: undefined;
     rules: SessionPermissionRules;
 };
 /**
- * 读一只 wire 上的 `SessionPermissionRules`:形不对给判词,形对给**只含五桶**的规则体。
+ * **形读者**:读一只 `SessionPermissionRules`,形不对给判词,形对给**只含五桶**的规则体。三个消费者:两条写入腿
+ * (经 {@link readWritableSessionPermissionRules})与 SQL 店的**读回**(`session-policy-store-sql.ts` 的
+ * `readSessionRulesBody`:读不出形的行判 `corrupt`)。
  *
  * 认识面窄得刻意:**只判形**,不判内容(桶内字符串的 pattern 文法、路径是否可达、tighten-only 是否成立
- * 都不在这里 —— 前两者归 core 的 rule 文法与 `normalizeRules`,后者归 `putRules` 的收紧门)。
- * 未知键**照旧忽略**(不是新的拒因):core 的 `normalizeRules` 本来就只搬这五桶,本读者与它同口径。
+ * 都不在这里 —— 前两者归 core 的 rule 文法与 `normalizeRules`,后者归 `putRules` 的收紧门;S-800 的名字判官
+ * 只在**写口**那一只读者里,见下)。未知键**照旧忽略**(不是新的拒因):core 的 `normalizeRules` 本来就只搬这五桶,
+ * 本读者与它同口径。
  */
-export declare function readSessionPermissionRules(raw: unknown): SessionPermissionRulesRead;
+export declare function readSessionPermissionRules(raw: unknown): SessionPermissionRulesRead<SessionPermissionRulesShapeProblem>;
+/**
+ * **写口读者**(S-800)= 形读者 + 名字判官:两条写入腿(`PUT /v1/sessions/:id/policy`、sync/import 的 `policy`
+ * 面经 {@link readSessionRulesRecords})往会话规则店写之前的**唯一**判据。两问,按序:
+ *  ① 形(同 {@link readSessionPermissionRules};一份坏形的体答形的 400);
+ *  ② 工具名桶里的每一条过 {@link legacyToolNameOf} —— 写进去之后属主撤不掉、会话之后每一跑都起不来的名字,
+ *     写口是唯一来得及拒的地方。
+ * 🔴 **只在写口,不在读回**:SQL 店读回同一行时只判形(形读者)。一条早先写进去的退役名行必须**读得出来** ——
+ * 那是运营方清掉它的唯一路径(operator 的 PUT 先读写前快照),也是 core 准备阶段报 `config.legacy_tool_name`
+ * 而不是一只 500 `corrupt` 的前提。把判官放进形读者会让读回把它判坏(7.105.0 车QQ 双库套件实抓,修在同批)。
+ */
+export declare function readWritableSessionPermissionRules(raw: unknown): SessionPermissionRulesRead;
 /** 一条 `SessionRulesRecord` 的形问题(`policy[]` 的元素级;桶级问题原样转载在 `rules` 位)。 */
 export type SessionRulesRecordProblem = 
 /** `policy` 本身不是数组。 */
@@ -90,6 +161,8 @@ export type SessionRulesRecordsRead = {
 };
 /**
  * 读 sync/import 的 `policy` 面(`SessionRulesRecord[]`)。好形返回**已收窄**的记录数组,坏形给判词。
+ * 它只服务那一条**写入**腿(导入的记录随后 `putRules` 进店),所以每条记录的规则体走**写口读者**
+ * {@link readWritableSessionPermissionRules}(与 PUT 腿同一只判官)。
  *
  * `rev`:记录里带的 `rev` 是**导出端的**乐观锁读数,`putRules` 侧一进门就 `stripRev` 掉(`sameRulesContent`
  * 也比的是去 rev 的字节形),所以它在本读者里只是过境位 —— 非数字即当缺席(不是拒因:一个坏 rev 改变不了
@@ -98,6 +171,15 @@ export type SessionRulesRecordsRead = {
 export declare function readSessionRulesRecords(raw: unknown): SessionRulesRecordsRead;
 /** 桶级判词 → 人话。闭集穷尽:{@link SessionPermissionRulesProblem} 加一种判词 ⇒ 本 switch 编译红。 */
 export declare function describeSessionPermissionRulesProblem(p: SessionPermissionRulesProblem): string;
+/**
+ * S-800:一只 `policy[]` 判词**是不是**「写得进却跑不了的名字」那一类 —— 是就交回那一格(桶 + 名字),
+ * 调用点据此发 `rules.legacy_tool_name`,否则发形的码。闭集穷尽两层:记录级判词或桶级判词加一种 ⇒ 编译红,
+ * 新判词不会静默落进某一个码。
+ */
+export declare function legacyToolNameProblemOf(p: SessionRulesRecordProblem): {
+    field: ToolNameRuleField;
+    name: string;
+} | undefined;
 /** `policy[]` 判词 → 人话(sync/import 腿在它前面拼 `policy: `)。闭集穷尽同上。 */
 export declare function describeSessionRulesRecordProblem(p: SessionRulesRecordProblem): string;
 /**
@@ -115,7 +197,10 @@ export declare function describeSessionRulesRecordProblem(p: SessionRulesRecordP
  *
  * 逐词:
  *  · `conflict`(409)—— CAS 输了,重读 `rev` 再来。**码位与状态逐字不变**。
- *  · `loosen_forbidden`(403)—— 非 operator 想放松。**码位与状态逐字不变**。
+ *  · `loosen_forbidden`(403)—— 非 operator 想放松。**码位与状态逐字不变**。⚠️ 这个词还有**第二个铸点**(S-546 B5,
+ *    如实登记、未改):PG 后端的 SQL 双生对含 NUL / 孤代理字节的规则拒收时借用了它
+ *    (`plugins/session-policy-store-sql.ts` 的 `pgHasUnstorable` 臂)—— 那一形**既非放宽也非越权**,operator 写同样撞上;
+ *    core 的闭集里没有「输入不可存」这个词,改码位要先裁定新码与 PUT / 2c 导入两条入口同判(DEBTS S-546 B5)。
  *  · `corrupt`(**500**)—— 店读不出它自己该读的那份字节(记号/行被列外篡改或撕裂)。
  *    不是 4xx:调用方没做错任何事,它也改不了这件事;不是 503:重试改不了判(core 成文的修复路径是
  *    **人**去改回或删掉那一行,而删记号要交出它握着的那个号)。
@@ -124,4 +209,5 @@ export declare function sessionPolicyErrorHttp(code: SessionPolicyError["code"])
     status: number;
     errorCode: string;
 };
+export {};
 //# sourceMappingURL=session-policy-wire.d.ts.map