@sema-agent/server 7.104.0 → 7.106.0

package/dist/trace/project.d.ts

@@ -156,8 +156,9 @@ export declare function toolStartEventData(ev: {
  * 🔴 **筛子是一只总函数**(S-239,codex 对抗复审 r1 [medium] 亲核复现后修)—— 上面纪律②许诺的
  * 「坏形 ⇒ report + withhold,**不抛**」此前是靠**逐条枚举**坏形兑现的,枚举不到的那些照样抛:
  * `projectSettlement` 对 `note` / `who.approver` 先 `redactSecrets` 再截断,而 `redactSecrets` 会在
- * 病态输入上爆回溯栈(`RangeError`:≥2^23 单段那一形已由 S-219 的 `atLeast` 铸点闭掉,仍能抛的是 JSON 秘密字段臂的
- * 转义对循环,S-102/S-106 登记的既有上界,见 `redact.ts` 该行顶注),两条叶各能抛一次。
+ * 病态输入上爆回溯栈(`RangeError`:≥2^23 单段那一形已由 S-219 的 `atLeast` 铸点闭掉,JSON 秘密字段臂的转义对循环与
+ * PEM 栅栏臂的标签交替循环由 S-265 换成手写扫描器闭掉 —— 已知形全部闭掉,本段写的是「当时为什么要总函数化」),
+ * 两条叶各能抛一次。总函数化照留:它兑现的是「坏字节一律 withhold」这条**结构**,不依赖脱敏器今天抛不抛。
  *
  * 抛出去的代价按腿算,而且一条比一条重:写腿落账那处的 `.catch` 看不到**同步**投影期的异常;读腿上它
  * 直接逃出 `formatEvent` / 投影函数 —— 账本裸回放腿的那一次会当场断流(那一行不上帧、游标不前进、后面的
@@ -295,7 +296,9 @@ export declare function toolEndEventData(ev: {
  * **不等于** `tool_end` 的 duration)。
  *
  * ## 信任划线
- *  · `toolCallId` / `toolName` —— 引擎铸的 id 与名册里的工具名(与 `tool_start` 逐字同源)⇒ verbatim。
+ *  · `toolCallId` / `toolName` —— 调用 id(🔴 S-283 订正:**服务商**在 tool_use / tool_calls 里给的,引擎只在缺席时自铸兜底 ——
+ *    此前写「引擎铸」不实)与名册里的工具名(与 `tool_start` 逐字同源)⇒ verbatim。调用 id 这一族在**逐帧面**上的形状闸
+ *    不在 S-283 射程(它是全 wire 的 join 键,要闸得所有面一起闸,见 run-terminal `admitProviderEcho` 顶注与车QO 收车档)。
  *  · `elapsedTimeSeconds` —— 引擎铸的整秒,单调、一 call 一个原点 ⇒ 有限数才铸键。
  *  · `output` —— 🔴 **UNTRUSTED RAW**,core 逐字「exactly as `tool_end.output`: process output that may
  *    carry secrets, paths or PII; core bounds only its SIZE, and a consumer MUST redact before persisting
@@ -575,8 +578,9 @@ export declare function workspaceChangedEventData(ev: {
  *       两词:core 只看合成后的 caps deny 位,本仓分得出这个 false 是 center 下发的还是本地 env 写的)。
  *       ⚠️ **`settings_denied` 不折进 `denied`,它折进 `no_intent`**(codex 车BO r1 [medium] 验真后纠):
  *       settings 层的 kill-switch 折的是**模式**(`effectivePermissionMode`:auto → default),于是 resolve-spec
- *       阶段④ 压根不写意图座 `TaskSpec.autoModeRequested` ⇒ core 的武装谓词第一项就落空;而本地 env 腿折的是
- *       **caps**(`applyLocalAutoModeDeny`),模式不动、座照写 ⇒ core 才报 `denied`。两条腿在 manifest 上
+ *       阶段④ 写的 `TaskSpec.permissionMode` 是 `"default"`(S-877 前是「不写意图座 `autoModeRequested`」)⇒ core 的武装谓词第一项就落空;
+ *       而本地 env 腿折的是 **caps**(`applyLocalAutoModeDeny`),模式照写 `"auto"` ⇒ core 才报 `denied`(并按 `operator_deny` 折 default、发
+ *       `config.permission_mode_unavailable`)。两条腿在 manifest 上
  *       **分不开**,要分辨得读 `/v1/capabilities`。对照表与保鲜钉在 `test/wiring-manifest-projection.test.ts`
  *       的 147③ 节,分岔的行为面格在 `test/permission-mode-shell-gate-translation.test.ts`;
  *       本函数**只透传**,一个字都不换。
@@ -925,8 +929,10 @@ export declare function contextUsageEventData(ev: {
  *
  * `responseModel`(core 7.29.0 #1029):**供应商自己**报的、回答这一 turn 的模型名,**只在**它 ≠ 请求所带 id
  * 时在场。缺席 = 「报了同名」或「没报」,**一个读法**(请求 id 读 `TaskResult.model`)。值是供应商铸的名字
- * (与 `apiFailure.requestId` 同类:不是模型写的自由文本)⇒ 逐字;非串 / 空串 ⇒ 缺席(core 的读律
- * `providerReportedModel` 对空串答「没报」,本仓不铸一个看起来合法的空名)。
+ * (与 `apiFailure.requestId` 同类:不是模型写的自由文本)⇒ 🔴 **S-283 起过 provider 回声的形状闸**
+ * ({@link admitProviderEcho}:长度 1–128 的可见 ASCII 原样,越界 ⇒ 不铸键 + 计数,与 core #1204 源头闸同一条;不过脱敏器),
+ * 与结果面的孪生 `TaskResult.responseModel` 同一只闸 —— 同一个名字在两张脸上不许两种待遇。非串 / 空串同样不铸键(空串在
+ * 那条谓词的长度下界之外;core 的读律 `providerReportedModel` 对空串也答「没报」)。
  */
 export declare function turnEndEventData(ev: {
     usage?: unknown;

package/dist/trace/project.js

@@ -1,5 +1,5 @@
-import { redactErrorMessage, redactModelText } from "../observability/run-terminal.js";
-import { MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, screenGateOutcome, TEAM_ROLES, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
+import { admitProviderEcho, redactErrorMessage, redactModelText } from "../observability/run-terminal.js";
+import { isAskClass, isAskOrigin, isPermissionMode, isPersistedRuleMandate, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, screenGateOutcome, TEAM_ROLES, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
 import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets, redactDeep } from "./redact.js";
@@ -103,6 +103,34 @@ export function screenedGate(v) {
         return undefined;
     }
 }
+function modeLedgerDefect(d) {
+    const classesOk = (v) => Array.isArray(v) && v.every((c) => isAskClass(c));
+    if (d.kind === "denied") {
+        if (d.mode !== undefined && !isPermissionMode(d.mode))
+            return "disposition.mode is outside the closed set";
+        if (d.askClass !== undefined && !isAskClass(d.askClass))
+            return "disposition.askClass is outside the closed set";
+        if (d.classes !== undefined && !classesOk(d.classes))
+            return "disposition.classes is not a list of ask classes";
+        return false;
+    }
+    if (d.released === undefined)
+        return false;
+    const r = d.released;
+    if (r === null || typeof r !== "object")
+        return "disposition.released is not an object";
+    const o = r;
+    if (!isPermissionMode(o.mode) || !isAskClass(o.askClass) || !classesOk(o.classes))
+        return "disposition.released.mode / askClass / classes is outside its closed set";
+    if (o.origin !== undefined && !isAskOrigin(o.origin))
+        return "disposition.released.origin is outside the closed set";
+    if (o.mandate !== undefined && !isPersistedRuleMandate(o.mandate))
+        return "disposition.released.mandate is outside the closed set";
+    if (o.reason !== undefined && !(typeof o.reason === "string" && Object.hasOwn(RELEASE_REASON_WORDS, o.reason)))
+        return "disposition.released.reason is outside the closed set";
+    return false;
+}
+const RELEASE_REASON_WORDS = { rule_unreadable: true };
 function screenedGateOrThrow(v) {
     if (v === null || typeof v !== "object") {
         if (v !== undefined)
@@ -121,6 +149,7 @@ function screenedGateOrThrow(v) {
         (d.classifier !== undefined && (d.classifier === null || typeof d.classifier !== "object") && "disposition.classifier is not an object") ||
         (classifierFallbackRaw !== undefined && (classifierFallbackRaw === null || typeof classifierFallbackRaw !== "object") && "disposition.classifier.fallback is not an object") ||
         (classifierFallbackRaw !== undefined && classifierFallbackRaw !== null && typeof classifierFallbackRaw === "object" && typeof classifierFallbackRaw.cause !== "string" && "disposition.classifier.fallback.cause is not a string") ||
+        modeLedgerDefect(d) ||
         (g.settlement !== undefined && (g.settlement === null || typeof g.settlement !== "object") && "settlement is not an object") ||
         (g.settlement !== undefined && g.settlement !== null && typeof g.settlement.kind !== "string" && "settlement.kind is not a string") ||
         (g.origin !== undefined && typeof g.origin !== "string" && "origin is not a string") ||
@@ -149,10 +178,29 @@ function screenedGateOrThrow(v) {
         recordFailOpen("server.trace.gate-outcome-defective", "settlement.who is not an object with a party in the closed set");
         return undefined;
     }
+    const rel = d.kind === "allowed" ? d.released : undefined;
+    const released = rel === undefined
+        ? undefined
+        : {
+            mode: rel.mode,
+            askClass: rel.askClass,
+            classes: [...rel.classes],
+            ...(rel.origin === undefined ? {} : { origin: rel.origin }),
+            ...(rel.mandate === undefined ? {} : { mandate: rel.mandate }),
+            ...(rel.reason === undefined ? {} : { reason: rel.reason }),
+        };
     return {
         disposition: d.kind === "denied"
-            ? { kind: "denied", deniedBy: d.deniedBy, ...(d.cause === undefined ? {} : { cause: d.cause }), ...(classifier === undefined ? {} : { classifier }) }
-            : { kind: "allowed", ...(classifier === undefined ? {} : { classifier }) },
+            ? {
+                kind: "denied",
+                deniedBy: d.deniedBy,
+                ...(d.cause === undefined ? {} : { cause: d.cause }),
+                ...(classifier === undefined ? {} : { classifier }),
+                ...(d.mode === undefined ? {} : { mode: d.mode }),
+                ...(d.askClass === undefined ? {} : { askClass: d.askClass }),
+                ...(d.classes === undefined ? {} : { classes: [...d.classes] }),
+            }
+            : { kind: "allowed", ...(classifier === undefined ? {} : { classifier }), ...(released === undefined ? {} : { released }) },
         ...(settlement === undefined ? {} : { settlement }),
         ...(g.origin === undefined ? {} : { origin: g.origin }),
     };
@@ -300,7 +348,7 @@ export function taskNotificationEventData(ev) {
             ? {
                 apiFailure: {
                     ...(typeof n.apiFailure.status === "number" ? { status: n.apiFailure.status } : {}),
-                    ...(typeof n.apiFailure.requestId === "string" ? { requestId: n.apiFailure.requestId } : {}),
+                    ...(admitProviderEcho(n.apiFailure.requestId, "task_notification.apiFailure.requestId") ? { requestId: n.apiFailure.requestId } : {}),
                 },
             }
             : {}),
@@ -756,7 +804,7 @@ export function turnEndEventData(ev) {
         ...(ev.usage ? { usage: ev.usage } : {}),
         ...(ev.usageMissing === true ? { usageMissing: true } : {}),
         ...(typeof ev.stopReason === "string" ? { stopReason: ev.stopReason } : {}),
-        ...(typeof ev.responseModel === "string" && ev.responseModel !== "" ? { responseModel: ev.responseModel } : {}),
+        ...(admitProviderEcho(ev.responseModel, "turn_end.responseModel") ? { responseModel: ev.responseModel } : {}),
         ...identityFields(ev),
     };
 }

package/dist/trace/redact.d.ts

@@ -72,6 +72,13 @@ declare const DISPLAY_SAFE_URL_TOKEN = "\u00ABredacted:url\u00BB";
 /** S-776:出网代理 URL 的回显尺(`outbound-dispatcher.ts` `displayProxyUrl`)形不干净时整只用**同一枚**占位 —— 单独一行导出,
  *  上面那行字面量保持 `const NAME = "…";` 形(`test/api-notice-text-freeze.test.ts` §6 的冻结扫描按这一形认替换 token)。 */
 export { DISPLAY_SAFE_URL_TOKEN };
+/** 测试可见(S-265 真值表的两半):结构段里**表行只作声明、实现是手写扫描器**的臂 —— 声明正则的**新拷贝**
+ *  (`lastIndex` 不与模块内那一枚共享)+ 扫描器在一份原文上产的候选跨度 `[起, 止)`。臂名是闭集 ⇒ 穷尽 `switch`
+ *  (少一个 `case` = 缺返回 = 编译红)。 */
+export declare function structuralScannerForTest(arm: "json-secret-field" | "pem-fence"): {
+    declared: RegExp;
+    spans: (text: string) => Array<[number, number]>;
+};
 /** 测试可见:扫描器 indexOf 实际扫过的字节数(摊还线性 ⇒ ≤ 常数 × 输入长)。 */
 export declare function ppkScanBytesForTest(): number;
 export declare function resetPpkScanBytesForTest(): void;

package/dist/trace/redact.js

@@ -486,13 +486,12 @@ function deriveLiteralHead(re) {
 function scanResumeAfterHit(start, end, back) {
     return Math.max(start + 1, end - back);
 }
-const spanOffset = (a, m) => (a.outside === 1 ? m[1].length : 0);
 function collectRegexSpans(a, text, out) {
     const g = a.g;
     g.lastIndex = 0;
     for (let m = g.exec(text); m !== null; m = g.exec(text)) {
         const end = m.index + m[0].length;
-        out.push({ start: m.index + spanOffset(a, m), end, repl: a.repl, rank: a.rank, order: a.order });
+        out.push({ start: m.index, end, repl: a.repl, rank: a.rank, order: a.order });
         g.lastIndex = scanResumeAfterHit(m.index, end, a.back);
     }
 }
@@ -585,7 +584,7 @@ function collectStickySpans(a, text, at, out) {
         if (m === null)
             continue;
         const end = p + m[0].length;
-        out.push({ start: p + spanOffset(a, m), end, repl, rank, order });
+        out.push({ start: p, end, repl, rank, order });
         pos = scanResumeAfterHit(p, end, back);
     }
 }
@@ -935,6 +934,47 @@ function collectSsh2FenceSpans(text, span) {
         from = scanResumeAfterHit(fence, end, SSH2_FENCE_OPEN.length);
     }
 }
+const PEM_END_OPEN = "-----END";
+const PEM_FENCE_BODY_MAX = 8192;
+function pemFenceLineEnd(text, labelFrom) {
+    const close = text.indexOf(PEM_FENCE_CLOSE, labelFrom);
+    return close >= 0 && isPemFenceLabel(text, labelFrom, close) ? close + PEM_FENCE_CLOSE.length : -1;
+}
+function collectPemFenceSpans(text, span) {
+    let endFrom = -1;
+    let endAt = -1;
+    let endAfter = -1;
+    const earliestEndFence = (from) => {
+        if (endFrom >= 0 && from >= endFrom && (endAt < 0 || endAt >= from))
+            return;
+        let b = text.indexOf(PEM_END_OPEN, from);
+        let after = -1;
+        while (b >= 0 && (after = pemFenceLineEnd(text, b + PEM_END_OPEN.length)) < 0)
+            b = text.indexOf(PEM_END_OPEN, b + 1);
+        endFrom = from;
+        endAt = b;
+        endAfter = after;
+    };
+    for (let from = 0;;) {
+        const fence = text.indexOf(PEM_FENCE_OPEN, from);
+        if (fence < 0)
+            return;
+        const bodyFrom = pemFenceLineEnd(text, fence + PEM_FENCE_OPEN.length);
+        if (bodyFrom < 0) {
+            from = fence + 1;
+            continue;
+        }
+        earliestEndFence(bodyFrom);
+        if (endAt < 0)
+            return;
+        if (endAt - bodyFrom > PEM_FENCE_BODY_MAX) {
+            from = fence + 1;
+            continue;
+        }
+        span(fence, endAfter);
+        from = scanResumeAfterHit(fence, endAfter, PEM_FENCE_OPEN.length);
+    }
+}
 function collectPemFragmentSpans(text, json, span) {
     let cur = findPemFence(text, 0);
     let inherited = false;
@@ -1145,6 +1185,18 @@ const SSH2_FENCE_PATTERN = (() => {
         throw new Error("redact: SSH2 fence rule missing from FULL_ARM_PATTERNS");
     return row;
 })();
+const PEM_FENCE_PATTERN = (() => {
+    const row = FULL_ARM_PATTERNS.find(([re]) => re.source.startsWith(PEM_FENCE_OPEN));
+    if (row === undefined)
+        throw new Error("redact: PEM fence rule missing from FULL_ARM_PATTERNS");
+    return row;
+})();
+const JSON_SECRET_FIELD_PATTERN = (() => {
+    const rows = FULL_ARM_PATTERNS.filter(([, repl]) => repl === '$1"«redacted»"');
+    if (rows.length !== 1)
+        throw new Error(`redact: expected exactly one JSON secret-field rule (replacement '$1"«redacted»"') in FULL_ARM_PATTERNS, found ${rows.length}`);
+    return rows[0];
+})();
 const isRegexSpace = (c) => c === 32 || (c >= 9 && c <= 13) || c === 0xa0 || c === 0x1680 || (c >= 0x2000 && c <= 0x200a) || c === 0x2028 || c === 0x2029 || c === 0x202f || c === 0x205f || c === 0x3000 || c === 0xfeff;
 const isLineTerminator = (c) => c === 10 || c === 13 || c === 0x2028 || c === 0x2029;
 const isControlCode = (c) => c < 0x20 || c === 0x7f;
@@ -1360,6 +1412,78 @@ function collectUrlCredentialSpans(text, json, span) {
         i = valueEnd - 1;
     }
 }
+const JSON_FIELD_ANCHOR = '"';
+const CREDENTIAL_NAME_MAX = Math.max(...CREDENTIAL_NAME_WORDS.map((w) => w.length));
+function jsonSecretFieldValueQuoteAt(text, p) {
+    const n = text.length;
+    let name = "";
+    let i = p + 1;
+    for (; i < n; i++) {
+        let c = text.charCodeAt(i);
+        if (c === CH_QUOTE)
+            break;
+        if (i - p > CREDENTIAL_NAME_MAX)
+            return -1;
+        if (c >= CH_A && c <= CH_Z)
+            c += 32;
+        if (!((c >= CH_a && c <= CH_z) || (c >= CH_0 && c <= CH_9) || c === CH_UNDERSCORE || c === CH_MINUS))
+            return -1;
+        name += String.fromCharCode(c);
+    }
+    if (i >= n || !CREDENTIAL_NAME_SET.has(name))
+        return -1;
+    i += 1;
+    while (i < n && isRegexSpace(text.charCodeAt(i)))
+        i += 1;
+    if (text.charCodeAt(i) !== CH_COLON)
+        return -1;
+    i += 1;
+    while (i < n && isRegexSpace(text.charCodeAt(i)))
+        i += 1;
+    return text.charCodeAt(i) === CH_QUOTE ? i : -1;
+}
+function jsonStringEndAt(text, q) {
+    const n = text.length;
+    for (let i = q + 1; i < n;) {
+        const c = text.charCodeAt(i);
+        if (c === CH_QUOTE)
+            return i + 1;
+        if (c === CH_BACKSLASH) {
+            if (i + 1 < n && !isLineTerminator(text.charCodeAt(i + 1))) {
+                i += 2;
+                continue;
+            }
+            return -1;
+        }
+        i += 1;
+    }
+    return -1;
+}
+function collectJsonSecretFieldSpans(text, span) {
+    for (let p = text.indexOf(JSON_FIELD_ANCHOR); p >= 0;) {
+        const q = jsonSecretFieldValueQuoteAt(text, p);
+        const end = q < 0 ? -1 : jsonStringEndAt(text, q);
+        if (end < 0) {
+            p = text.indexOf(JSON_FIELD_ANCHOR, p + 1);
+            continue;
+        }
+        span(q, end);
+        p = text.indexOf(JSON_FIELD_ANCHOR, scanResumeAfterHit(p, end, JSON_FIELD_ANCHOR.length));
+    }
+}
+export function structuralScannerForTest(arm) {
+    const collect = (scan) => (text) => {
+        const out = [];
+        scan(text, (start, end) => out.push([start, end]));
+        return out;
+    };
+    switch (arm) {
+        case "json-secret-field":
+            return { declared: new RegExp(JSON_SECRET_FIELD_PATTERN[0].source, JSON_SECRET_FIELD_PATTERN[0].flags), spans: collect(collectJsonSecretFieldSpans) };
+        case "pem-fence":
+            return { declared: new RegExp(PEM_FENCE_PATTERN[0].source, PEM_FENCE_PATTERN[0].flags), spans: collect(collectPemFenceSpans) };
+    }
+}
 let ppkScanBytes = 0;
 export function ppkScanBytesForTest() { return ppkScanBytes; }
 export function resetPpkScanBytesForTest() { ppkScanBytes = 0; }
@@ -1462,56 +1586,19 @@ const armPool = (() => {
             throw new Error(`redact: arm-pool replacement ${JSON.stringify(token)} may only use a leading $1 (the run kept outside the span)`);
         return body;
     };
-    const literalAnchorHead = (re) => {
-        const src = re.source;
-        let i = src.startsWith("(") && !src.startsWith("(?") ? 1 : 0;
-        let out = "";
-        for (; i < src.length; i++) {
-            const c = src[i];
-            if (c === "\\") {
-                const e = src[i + 1];
-                if (e === undefined || !HEAD_LITERAL_ESCAPES.has(e))
-                    break;
-                if ("*+?{".includes(src[i + 2] ?? ""))
-                    break;
-                out += src.slice(i, i + 2);
-                i += 1;
-                continue;
-            }
-            if ("([{|).^$*+?".includes(c))
-                break;
-            if ("*+?{".includes(src[i + 1] ?? ""))
-                break;
-            out += c;
-        }
-        if (out.length === 0)
-            throw new Error(`redact: structural arm /${src}/ has no literal anchor head — its same-arm rewind amount cannot be derived`);
-        return out;
-    };
-    const regexMember = ([re, token], rank, order, structural) => {
+    const regexMember = ([re, token], rank, order) => {
+        if (token.startsWith("$1"))
+            throw new Error(`redact: regex arm /${re.source}/ cannot carry an outside-span $1 prefix — that form belongs to the structural scanners`);
         const repl = spanRepl(token);
-        const outside = token.startsWith("$1") ? 1 : 0;
         const y = VALUE_ARM_STICKY.get(re);
-        let back;
-        let headSrc;
-        let headFirst;
-        if (structural) {
-            back = literalAnchorHead(re).length;
-            headSrc = undefined;
-            headFirst = undefined;
-        }
-        else {
-            const d = deriveLiteralHead(re);
-            back = Math.max(d.len - 1, 0);
-            headSrc = d.src;
-            headFirst = d.first;
-            if (y !== undefined && (d.len === 0 || headSrc === undefined || headFirst === undefined)) {
-                throw new Error(`redact: boundary arm /${re.source}/ has a zero-length structural head — the bounded head screen would admit every candidate position`);
-            }
+        const d = deriveLiteralHead(re);
+        const back = Math.max(d.len - 1, 0);
+        const headSrc = d.src;
+        const headFirst = d.first;
+        if (y !== undefined && (d.len === 0 || headSrc === undefined || headFirst === undefined)) {
+            throw new Error(`redact: boundary arm /${re.source}/ has a zero-length structural head — the bounded head screen would admit every candidate position`);
         }
-        if (y !== undefined && outside === 1)
-            throw new Error(`redact: value arm /${re.source}/ cannot carry an outside-span $1 prefix`);
-        const arm = { g: re, y, back, headSrc, headFirst, repl, rank, order, outside };
+        const arm = { g: re, y, back, headSrc, headFirst, repl, rank, order };
         const boundary = y === undefined || headSrc === undefined || headFirst === undefined ? undefined : { ...arm, y, headSrc, headFirst };
         return {
             token,
@@ -1541,24 +1628,29 @@ const armPool = (() => {
             headFirst: undefined,
         };
     };
+    const structuralScannerMember = (row, order) => {
+        if (row === PEM_FENCE_PATTERN)
+            return scannerMember(row[1], order, 1, (text, _json, _observe, span) => collectPemFenceSpans(text, span));
+        if (row === SSH2_FENCE_PATTERN)
+            return scannerMember(row[1], order, 2, (text, _json, _observe, span) => collectSsh2FenceSpans(text, span));
+        if (row === URL_CREDENTIAL_PATTERN)
+            return scannerMember(row[1], order, 2, (text, json, _observe, span) => collectUrlCredentialSpans(text, json, span));
+        if (row === JSON_SECRET_FIELD_PATTERN)
+            return scannerMember(row[1], order, 1, (text, _json, _observe, span) => collectJsonSecretFieldSpans(text, span));
+        throw new Error(`redact: structural row /${row[0].source}/ has no hand-written scanner — structural grammars are declared as regexes but never executed as one (S-102 / S-265)`);
+    };
     const members = [];
-    for (const row of STRUCTURAL_SECRET_PATTERNS) {
-        const order = members.length;
-        members.push(row === URL_CREDENTIAL_PATTERN
-            ? scannerMember(row[1], order, 2, (text, json, _observe, span) => collectUrlCredentialSpans(text, json, span))
-            : row === SSH2_FENCE_PATTERN
-                ? scannerMember(row[1], order, 2, (text, _json, _observe, span) => collectSsh2FenceSpans(text, span))
-                : regexMember(row, ARM_RANK.structural, order, true));
-    }
+    for (const row of STRUCTURAL_SECRET_PATTERNS)
+        members.push(structuralScannerMember(row, members.length));
     members.push(scannerMember(PPK_CONTAINER_TOKEN, members.length, 2, (text, _json, observe, span) => collectPpkContainerSpans(text, observe, span)));
     members.push(scannerMember(PEM_FRAGMENT_TOKEN, members.length, 2, (text, json, _observe, span) => collectPemFragmentSpans(text, json, span)));
     members.push(scannerMember(HEADLESS_PPK_TOKEN, members.length, 2, (text, _json, _observe, span) => collectHeadlessPpkSpans(text, span)));
     for (const row of KEYWORD_SECRET_PATTERNS)
-        members.push(regexMember(row, ARM_RANK.keyword, members.length, false));
+        members.push(regexMember(row, ARM_RANK.keyword, members.length));
     for (const row of SHAPE_SECRET_PATTERNS)
-        members.push(regexMember(row, ARM_RANK.shape, members.length, false));
+        members.push(regexMember(row, ARM_RANK.shape, members.length));
     for (const row of FRAGMENT_SECRET_PATTERNS)
-        members.push(regexMember(row, ARM_RANK.fragment, members.length, false));
+        members.push(regexMember(row, ARM_RANK.fragment, members.length));
     for (const [re] of KEYWORD_SECRET_PATTERNS) {
         if (!LEXICAL_KEYWORD_ARMS.has(re))
             throw new Error(`redact: keyword arm /${re.source}/ is not registered as lexical — build it with keywordArm() so the bounded-unit scope can exclude it`);

package/dist/trace/wire-projection-faces.d.ts

@@ -168,7 +168,7 @@ export declare const WIRE_PROJECTION_FACES: {
     readonly wiring_manifest_tenant: {
         readonly projector: "wiringManifestEventData";
         readonly coreType: `WiringManifest & ${string}`;
-        readonly excluded: readonly ["governance", "configFingerprint", "autoConsolidation", "readDeny", "peerPresence"];
+        readonly excluded: readonly ["governance", "configFingerprint", "autoConsolidation", "readDeny", "peerPresence", "permissionMode"];
         readonly unwrapped: readonly ["manifest"];
         readonly minted: readonly [];
     };

package/dist/trace/wire-projection-faces.js

@@ -40,7 +40,7 @@ export const WIRE_PROJECTION_FACES = {
     wiring_manifest_tenant: {
         projector: "wiringManifestEventData",
         coreType: `WiringManifest & ${arm("wiring_manifest")}`,
-        excluded: ["governance", "configFingerprint", "autoConsolidation", "readDeny", "peerPresence"],
+        excluded: ["governance", "configFingerprint", "autoConsolidation", "readDeny", "peerPresence", "permissionMode"],
         unwrapped: ["manifest"],
         minted: [],
     },

package/dist/unattended-permission-mode.d.ts

@@ -0,0 +1,110 @@
+/**
+ * S-877 候裁 15 → B(主会话裁定 2026-09-29,收车档 ⑩)—— `UNATTENDED_PERMISSION_MODE`:**无人值守腿的模式,运维一处表态**。
+ *
+ * ## 规则(一句)
+ * 本仓**自己铸** spec、**没有调用方**能在请求上表态模式、也**没有审批席**的腿 —— leader worker(`src/leader/wire.ts`
+ * provisionWorker 两车道)、leader 的两只修复腿(集成沙箱修复 `mkRepair`、模块门修复 `runModuleGate` / 单代理修复环
+ * `attachRepairLoopDeps`)、run-local(`src/run-local.ts`,一次性 CLI)—— 它们的 `TaskSpec.permissionMode` 由本旋钮给,
+ * 经 {@link unattendedPermissionMode} 这**一只**读函数取值,各腿不各读 config、不各写默认。
+ *
+ * ## 为什么要有它(对 v7.105.0 回归的修,codex 对抗复审 F1 [high] 亲核成立)
+ * core 7.34.0 [ref]「Absent = `default`」:不带 `permissionMode` 的 spec 按 `default` 跑 —— 模式写门对每一次写先问、
+ * 形状层对非只读 shell 先问。上面三类腿**没有人**能答那一问(leader 的 Runner 不接 `onAsk`,零名单部署也不给 durable 席;
+ * run-local 无 TTY 时同形)⇒ headless 当场拒:worker `completed`、零写入。7.105.0 上这些腿不带模式也不问
+ * (缺席臂只给 base、`shellGate` 不写)。core 同段逐字给出路:「A library embedder that writes files with no approver
+ * now declares `permissionMode: "acceptEdits"` … or `"bypassPermissions"` … or wires an approver」——本仓对自己铸的
+ * 那几条 spec 就是那个 embedder。
+ *
+ * ## 三问
+ *  · **谁需要**:用 leader / run-local 的部署(零审批名单是常态)—— 缺省值必须等于 7.105.0 的行为,否则升级即断。
+ *  · **谁受伤**:想让无人值守腿更严的运维 —— **补偿** = 把旋钮设成 `acceptEdits`(根内写不问、非只读命令仍问 ⇒ 无人可答即拒)
+ *    / `default` / `dontAsk`(一切会问的都拒)/ `plan`。部署的审批名单(`APPROVAL_REQUIRE` 等)与治理层的问(运维强制、ask 规则、
+ *    hook)在任何一个词下都**照问**:bypassPermissions 只放行「普通」一类(core 7.34.0 [ref] 仲裁表,本仓不重推)。
+ *  · **什么补偿**:缺省 = `bypassPermissions` —— 写门 / 形状层与 7.105.0 同(不问);词表外的值起服拒启([ref],不静默回缺省)。
+ *    候裁 18 → D:缺省 bypass 会释放写保护 ⇒ 本腿把写保护从问改成拒({@link createUnattendedWriteProtectionPolicy});另六类释放 = 相对 7.105.0 的宽化,
+ *    如实披露(见那只函数的「射程外」)。**过渡形**:core 7.37.0(S-906)后退成 `default` + 按类作答的 onAsk,旋钮硬删(拒启点名)。
+ *
+ * ## 写面:本旋钮只给模式的**仲裁**,不给 bypassPermissions 在 core 模式表里的**写面 open**
+ * core 7.34.0 起 `modePolicyOf("bypassPermissions").writeFace === "open"`(工作区根之外也能写)。7.105.0 上这几条腿**没有模式**,
+ * 写面恒是引擎缺省 `"roots"`。所以 {@link buildUnattendedLegSpec} 同时在任务席写 `writeFace: "roots"`(core 容纳面解析序:
+ * 显式任务席在模式那一行**之前**,`dist/tools/fs/containment-face.d.ts` resolveContainmentFace 第 3 / 3′ 行)—— 缺省与 7.105.0
+ * **逐字**同形,运维把旋钮设成任何词也不会顺手拿到根外写面(那是 HTTP 腿上 `TASK_WRITE_FACE_ESCALATION` 管的另一件事,
+ * S-591;这几条腿不是请求,不经那道门)。⚠️ 这一格是按裁定的**意图**(「= 7.105.0 行为」)施工、比裁定字面多出的一半,
+ * 收车档 ⑩ 单列,主会话可翻。
+ *
+ * ## 射程外(成文)
+ *  · HTTP 腿(`POST /v1/tasks|runs`):模式在请求上(`permissionMode` / `settings.permissions.defaultMode`),缺席 = core `default`
+ *    原样过境(候裁 5 裁 A)—— 那里有调用方能表态,本旋钮不参与。
+ *  · leader 的 planner 路由(无手 Runner,没有写 / shell 可问)不读本旋钮。
+ *  · 中心下发 `RuntimeCaps.bypassPermissions === false` 时 core 把 bypass 折回 `default` 并发 `config.permission_mode_unavailable`
+ *    —— 组织级拒优先。本仓今天不写这一位([ref] 未闭环),故这条今天只在 core 侧可达。
+ */
+import { type PermissionMode, type RunnerDeps, type TaskSpec, type ToolPolicy } from "@sema-agent/core";
+/** 旋钮的出厂值(主会话裁定候裁 15 B / 18 D)。写面由 {@link buildUnattendedLegSpec} 钉 roots;写保护由 {@link createUnattendedWriteProtectionPolicy} 改拒。 */
+export declare const UNATTENDED_PERMISSION_MODE_DEFAULT: "bypassPermissions";
+/** 解析结果:值 + 它从哪来(boot 一行 `unattended_permission_mode` 的两个字段)。 */
+export interface UnattendedPermissionModeSetting {
+    readonly value: PermissionMode;
+    readonly source: "env" | "default";
+}
+/**
+ * `UNATTENDED_PERMISSION_MODE` 的**唯一**解析口。词表 = core `PERMISSION_MODES` 本尊(不手抄 —— core 加词本口随之受理,
+ * 减词本口随之拒启);两侧空白裁掉后**逐字**比较(不折大小写:`Default` / `BYPASS` 落拒启臂)。
+ * 未设 / 空串 ⇒ 出厂值,来源 `default`;词表外 ⇒ **拒启**,拒因点名旋钮与全部合法词([ref]:安全轴旋钮不许「以为设了其实没设」)。
+ */
+export declare function parseUnattendedPermissionMode(raw: string | undefined): UnattendedPermissionModeSetting;
+/** 三类无人值守腿的**唯一**读函数(见模块头注「规则」)。 */
+export declare function unattendedPermissionMode(config: {
+    readonly unattendedPermissionMode: PermissionMode;
+}): PermissionMode;
+/** 无人值守腿铸进 spec 的两键(纯数据 ⇒ `build*`):模式 = 旋钮值;写面 = `"roots"`(理由见模块头注「写面」)。 */
+export declare function buildUnattendedLegSpec(mode: PermissionMode): Required<Pick<TaskSpec, "permissionMode" | "writeFace">>;
+/**
+ * 🔴 **S-877 候裁 18 → D(主会话续裁 2026-09-29)—— 无审批席的腿上,写保护从「问」改成「拒」**。
+ *
+ * **病**(codex 续车轮 R2-F1):core `MODE_ARBITRATION` 里 `bypassPermissions` 释放 `write_protection` 一类(`bypassImmune:false`)⇒ 旋钮缺省下写保护表里的
+ * 目标零询问放行;7.105.0 这些腿无模式 ⇒ 写保护是一问 ⇒ 无人可答 ⇒ 拒。core 7.35 没有「放普通问、留保护问」的模式,也没有限定模式可释放类的座。
+ *
+ * **规则(一条)**:本腿的模式**会释放**写保护一问时(读 core 仲裁本尊 `arbitrateByMode`,不手抄模式词),把**本腿引擎判官用的同一张写保护表**
+ * (`runnerSeats` = 构造本腿 Runner 的那份 deps 的两只座 {@link UnattendedLegRunnerSeats};`writeProtectedPaths` 缺席 = core 源表 `WRITE_PROTECTED_DEFAULT_TABLE`)经 core 的
+ * `compileWriteProtection` 编成判官,每一行铸成一条 **core 路径拒行**(`ToolPolicy.pathDenyRules`,`faces:["write"]`)—— 引擎的写面把它们并进本腿的拒表:
+ * 写工具的路径解析与 shell 站(重定向 / `tee` / `sed -i` / `cp`·`mv`·`touch` 操作数)都按拒表拒,模式**不释放拒**。**路径匹配全在 core**:每行的
+ * `reaches` 就是判官自己的 `matchPath`(同一只折叠、同一只数据根放行 —— `dataRoot` 与引擎判官同源:本腿 Runner 的 `memoryEngineDir`),本仓不写一个字的
+ * 路径比较。模式不释放写保护(`default` / `acceptEdits` / `plan` / `auto` / `dontAsk`)⇒ 不铸(那一问照旧问,有席的腿上人能答 —— run-local 有 TTY 时)。
+ *
+ * **射程外**(如实,收车档 ⑩ 候裁 18):缺省 bypass 还释放 `probe` / `tool_marks_mcp` / `tool_marks_a2a` / `transcript_write` / `rule_unreadable` /
+ * `artifact_shared_read` 六类(core 对它们没有「拒」的座),相对 7.105.0 是宽化 —— CHANGELOG「谁受伤」与 MIGRATION 写明,补偿 = 旋钮 `acceptEdits` / `default`。
+ * **过渡形**:core 7.37.0(S-906,`AskRequest.askClass?` / `classes?` 到货)后本仓改成 `default` 模式 + fail-closed 按类作答的 `onAsk`,本座与旋钮一并硬删。
+ * **续跑**(codex r3 F1):本层是活闭包、进不了 checkpoint,而 core 续跑在 spec 不说模式时取 checkpoint 记下的模式 ⇒ durable 续跑必须重挂整条腿 ——
+ * leader worker 的续跑上下文带 `CheckpointCtx.unattendedLeg`,续跑家族据此让 `resolveSpec` 在全部折叠之后调 {@link createUnattendedLeg} / {@link withUnattendedLeg}。
+ * **已知过拒**(codex r3 F2,fail-closed 方向,随过渡形退役):core 的路径拒座在 shell 站把 `cp` 的**源**操作数也按写目标判(CC 同形,cli280.js:216993
+ * `cp:"write"`),引擎写保护判官只判真写目标 ⇒ 从写保护目标复制出来在本层下被拒、7.105.0 上照跑。本仓不补路径比较(那是第二个判官),特征化钉在
+ * test/run-local.test.ts「🚧 codex r3 F2」。
+ * **附带效果**(S-877 四续 ⑫b,随过渡形退役):本层只能是一只 `ToolPolicy`(路径拒座挂在策略上,`check` 必填 —— 这里恒 `allow`),原先没有 toolPolicy
+ * 的腿因此被引擎读成「有策略层」:系统提示多 `# Execution environment` 一块、UNGATED 告警不再发。7.35.2 上表达不了「只供拒行、不算策略层」;
+ * 特征化钉在 test/unattended-permission-mode.test.ts「🚧 四续 ⑫b」。
+ *
+ * 返回 `undefined` = 本腿不需要这一层(模式不释放写保护,或运维把表清空 `[]`)。活对象(带判官闭包)⇒ `create*`。
+ */
+export declare function createUnattendedWriteProtectionPolicy(mode: PermissionMode, runnerSeats: UnattendedLegRunnerSeats): ToolPolicy | undefined;
+/** 无人值守腿的全部铸件:模式 + 写面(纯数据)与写保护拒层(活对象,可缺席)。由 {@link createUnattendedLeg} 铸、{@link withUnattendedLeg} 并进 spec。 */
+export interface UnattendedLeg {
+    readonly spec: Required<Pick<TaskSpec, "permissionMode" | "writeFace">>;
+    readonly writeProtection: ToolPolicy | undefined;
+}
+/**
+ * 引擎写保护判官读的两只 Runner 座(`RunnerDeps` 的同名切片):表(`writeProtectedPaths`,缺席 = core 源表)与数据根放行(`memoryEngineDir`,缺席 = 引擎缺省)。
+ * 调用方递**构造本腿 Runner 的那一份** deps(或它的展开源)—— 表与根从哪来、根要不要在,都由那份 deps 说了算,腿的接线处不再单独读任何一只坐标
+ * (本模块是唯一读者;S-877 四续:接线处各读一份就是「两边同一张表、同一个根」这句话的第二、三个写者)。
+ */
+export type UnattendedLegRunnerSeats = Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir">;
+/** 三处无人值守腿(leader worker / 修复腿 / run-local)与续跑重挂的**唯一**铸点:`mode` 取 {@link unattendedPermissionMode},`runnerSeats` = 本腿 Runner 的 deps
+ *  (引擎写保护判官与本层拒行同一张表、同一个数据根)。 */
+export declare function createUnattendedLeg(mode: PermissionMode, runnerSeats: UnattendedLegRunnerSeats): UnattendedLeg;
+/**
+ * 把无人值守腿并进一条 spec —— 三处腿的**唯一**合并口:两键覆盖(本腿的模式与写面由旋钮说了算),写保护拒层与 spec 已有的 `toolPolicy` **合成**
+ * (`combinePolicies`,deny-wins,携带 `pathDenyRules`)而不是覆盖(leader worker 的 durable 名单门、run-local 的治理链都在那里)。
+ * 调用点必须在 spec 其余键(含治理折叠)**之后**调它,否则后铸的 `toolPolicy` 会把拒层盖掉。
+ */
+export declare function withUnattendedLeg<S extends Partial<TaskSpec>>(spec: S, leg: UnattendedLeg): S & Required<Pick<TaskSpec, "permissionMode" | "writeFace">>;
+//# sourceMappingURL=unattended-permission-mode.d.ts.map

package/dist/unattended-permission-mode.js

@@ -0,0 +1,65 @@
+import { ASK_CLASSES, PERMISSION_MODES, arbitrateByMode, combinePolicies, compileWriteProtection, foldArbitrationRow } from "@sema-agent/core";
+import { recordFailOpen } from "./observability/fail-open.js";
+export const UNATTENDED_PERMISSION_MODE_DEFAULT = "bypassPermissions";
+export function parseUnattendedPermissionMode(raw) {
+    const trimmed = (raw ?? "").trim();
+    if (trimmed === "")
+        return { value: UNATTENDED_PERMISSION_MODE_DEFAULT, source: "default" };
+    const word = PERMISSION_MODES.find((m) => m === trimmed);
+    if (word === undefined) {
+        throw new Error(`env UNATTENDED_PERMISSION_MODE="${trimmed.slice(0, 120)}" is not a permission mode — use one of: ${PERMISSION_MODES.join(", ")} ` +
+            `(or leave it unset for the default "${UNATTENDED_PERMISSION_MODE_DEFAULT}", which keeps the unattended legs — leader workers / repairs and run-local — acting as they did before server 7.106.0). ` +
+            `The word is matched EXACTLY (surrounding whitespace trimmed, no case folding). ` +
+            `Refusing to boot rather than treating it as unset: that would run those legs under a mode the operator did not choose`);
+    }
+    return { value: word, source: "env" };
+}
+export function unattendedPermissionMode(config) {
+    return config.unattendedPermissionMode;
+}
+export function buildUnattendedLegSpec(mode) {
+    return { permissionMode: mode, writeFace: "roots" };
+}
+export function createUnattendedWriteProtectionPolicy(mode, runnerSeats) {
+    if (!modeReleases(mode, "write_protection"))
+        return undefined;
+    const dataRoot = runnerSeats.memoryEngineDir;
+    const judge = compileWriteProtection(runnerSeats.writeProtectedPaths, dataRoot !== undefined ? { dataRoot } : undefined);
+    if (judge === undefined)
+        return undefined;
+    const pathDenyRules = judge.rows.map((row) => ({
+        rule: `WriteProtected(${row.name})`,
+        tool: "Edit",
+        pattern: row.name,
+        faces: ["write"],
+        reaches: (absolutePath) => judge.matchPath(absolutePath)?.name === row.name,
+    }));
+    return {
+        check: () => ({ action: "allow" }),
+        pathDenyRules,
+    };
+}
+function modeReleases(mode, askClass) {
+    const classes = new Set([askClass]);
+    return arbitrateByMode(mode, { classes, askClass, row: foldArbitrationRow(classes) }).kind === "released";
+}
+const INTENDED_RELEASES = new Set(["ordinary", "mode"]);
+function releasedProtectiveClasses(mode) {
+    return ASK_CLASSES.filter((c) => !INTENDED_RELEASES.has(c) && c !== "write_protection" && modeReleases(mode, c));
+}
+const RELEASED_PROTECTIVE_ASKS_TAG = "server.unattended-leg.mode-releases-protective-asks";
+export function createUnattendedLeg(mode, runnerSeats) {
+    const debt = releasedProtectiveClasses(mode);
+    if (debt.length > 0)
+        recordFailOpen(RELEASED_PROTECTIVE_ASKS_TAG, `mode=${mode} released=${debt.join(",")}`);
+    return { spec: buildUnattendedLegSpec(mode), writeProtection: createUnattendedWriteProtectionPolicy(mode, runnerSeats) };
+}
+export function withUnattendedLeg(spec, leg) {
+    const wp = leg.writeProtection;
+    return {
+        ...spec,
+        ...leg.spec,
+        ...(wp !== undefined ? { toolPolicy: spec.toolPolicy !== undefined ? combinePolicies(spec.toolPolicy, wp) : wp } : {}),
+    };
+}
+//# sourceMappingURL=unattended-permission-mode.js.map