@sema-agent/server 7.105.0 → 7.106.0

package/dist/runtime-governance.d.ts

@@ -150,12 +150,12 @@ export declare function autonomyOverrides(autonomy: Autonomy | undefined): Parti
  */
 export declare function governanceMandatesShellGateAlways(governance: {
     autonomy?: Autonomy;
-    manualModeShellGate?: "always" | "classify";
+    manualModeShellGate?: ShellGateDoctrine;
 }): boolean;
 /** [ref] 归因的部署侧入参(两个治理旋钮;判据属主见 {@link governanceMandatesShellGateAlways})。 */
 export interface GovernancePosture {
     autonomy?: Autonomy;
-    manualModeShellGate?: "always" | "classify";
+    manualModeShellGate?: ShellGateDoctrine;
 }
 /**
  * [ref]:推「这道门是运维治理层下的吗」。判据是**合取**,两半各管一件事:
@@ -172,8 +172,9 @@ export interface GovernancePosture {
  * ⚠️ 残留(双向失真的窄在场向 + 根治路径)与「只收窄」的那一个裁决读者,都登记在
  * {@link governanceMandatesShellGateAlways} 的顶注,别在这里复述。
  *
- * 🔴 `"classify"` 档**刻意不标**:那一档由 core 的分类器逐调用裁决,一次 shell ask 可能出自分类器(治理)
- * 也可能出自 `APPROVAL_REQUIRE` 这类别的门,行上无从分辨 —— 与活卡腿同一条「宁缺毋假」纪律。
+ * 🔴 **形状档的 ask 刻意不标**(S-877 起它不再是一个档位词:core 7.34.0 把形状档装在**每一种模式**的全权 shell 上,
+ * 行上的 `shellGateDoctrine` 只在运维地板 `"always"` 铸门时出现):形状档的一次 shell ask 出自引擎自己的判断,
+ * 也可能叠着 `APPROVAL_REQUIRE` 这类别的门,行上无从分辨 —— 与活卡腿同一条「宁缺毋假」纪律。
  *
  * 🔴 **单一属主,四个读者**(不在任何读面另写一份判据 —— 这一位恰恰是靠「行上取证 ∧ 部署姿态」的合取才不
  * 谎报的,两份必漂):409 体的待批门材料(`http/active-run-conflict.ts`)、两条 durable 读面
@@ -196,10 +197,6 @@ export declare function governanceOriginOf(gate: {
         shellGateDoctrine?: ShellGateDoctrine;
     };
 } | undefined, governance: GovernancePosture | undefined): true | undefined;
-/** spec 序里的秩(0 起,越大越严)。入参收 `string`(fail-loud 边界:schema `trustRank` 同款姿势)——词表外 ⇒
- *  RangeError,绝不 undefined/NaN 让比较静默成 false。导出只为对表钉(test/safety-merge-spec-consumption.test.ts,
- *  [ref] 件4)——运行时消费仍走上表(键类型闭集)。 */
-export declare function shellGateRank(word: string): number;
 /**
  * Apply the operator's runtime governance (autonomy + commandPolicy + manualModeShellGate) onto a base
  * `TaskSpec`, TIGHTEN-ONLY, in a SINGLE {@link tightenTaskSpec} call: commandPolicy compiles to a `toolPolicy`
@@ -212,8 +209,8 @@ export declare function shellGateRank(word: string): number;
  * (task-settings deriveSettingsPolicy 的 default/auto/acceptEdits 三臂)让一个**部署级 tighten-only 旋钮
  * 的生死由客户端表态在场性决定**:body 无 settings/permissionMode(cli print/headless 腿按设计不 stamp)
  * ⇒ 旋钮静默失效(clay 实机 Monitor 案「门根本没铸」);bypassPermissions 一句话掀掉部署闸;非 host lane
- * fsWriteGate wiring 不建 ⇒ 沙箱 lane 全失效。governance 层与 autonomy 同拍施加后三者全闭。rank 合成:
- * autonomy 派生值与旋钮取大(ask→"always" 压过 "classify"),再对 base 只升不降(防 tightenTaskSpec throw)。
+ * fsWriteGate wiring 不建 ⇒ 沙箱 lane 全失效。governance 层与 autonomy 同拍施加后三者全闭。S-877 起地板只有
+ * `"always"` 一个词,合成退化成在场性(两个来源同词),不再有秩比较。
  *
  * [ref]([ref] issue #29,**邻仓 test AI 的 46 格真机矩阵**实证——不是本仓的钉,别到本仓文件里数 46;
  * 本仓的类级门是 test/operator-knob-client-posture-matrix.test.ts 的 旋钮×表态×lane 矩阵):
@@ -231,7 +228,7 @@ export declare function shellGateRank(word: string): number;
 export declare function applyRuntimeGovernance(base: TaskSpec, governance: {
     autonomy?: Autonomy;
     commandPolicy?: CommandRule[];
-    manualModeShellGate?: "always" | "classify";
+    manualModeShellGate?: ShellGateDoctrine;
     sensitivePathPolicy?: ToolPolicy;
     /** [ref]/[ref] `governanceForced` 的标记表(缺省 = **当前 run 腿的 ALS 表**,见
      *  `governance-ask-marks.ts` 顶注「作用域」段)。注入口只为测试与将来的多实例形。 */

package/dist/runtime-governance.js

@@ -1,7 +1,7 @@
-import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
-import { GovernanceConfig, SAFETY_MERGE_SPEC } from "@sema-agent/settings-schema";
+import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, wrapToolPolicy, } from "@sema-agent/core";
+import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
-import { operatorAsk } from "./operator-ask.js";
+import { operatorAsk, withDeploymentAuthorship } from "./operator-ask.js";
 const COMMAND_RULE_SHAPE = GovernanceConfig.shape.commandPolicy.unwrap().element.shape;
 const COMMAND_DECISIONS = COMMAND_RULE_SHAPE.decision.options;
 export const AUTONOMY_MODES = GovernanceConfig.shape.autonomy.unwrap().options;
@@ -124,14 +124,12 @@ export function governanceOriginOf(gate, governance) {
 function createGovernanceAskMarkingPolicy(inner, marksOf) {
     const note = (d, req) => {
         marksOf()?.setMarked(req.toolCallId, d.action === "ask");
-        return d;
-    };
-    return {
-        check(req, signal) {
-            const decision = inner.check(req, signal);
-            return decision instanceof Promise ? decision.then((d) => note(d, req)) : note(decision, req);
-        },
+        return d.action === "ask" ? withDeploymentAuthorship(d) : d;
     };
+    return wrapToolPolicy(inner, (req, signal) => {
+        const decision = inner.check(req, signal);
+        return decision instanceof Promise ? decision.then((d) => note(d, req)) : note(decision, req);
+    });
 }
 function createGovernanceShellGateMarkPolicy(marksOf, tools = COARSE_SHELL_TOOLS) {
     const shellTools = new Set(tools);
@@ -143,28 +141,6 @@ function createGovernanceShellGateMarkPolicy(marksOf, tools = COARSE_SHELL_TOOLS
         },
     };
 }
-const SHELL_GATE_RANK = (() => {
-    const tighten = SAFETY_MERGE_SPEC.shellGate.tighten;
-    const rule = tighten.rule;
-    if (tighten.rule !== "enumRank")
-        throw new Error(`SAFETY_MERGE_SPEC.shellGate.tighten.rule=${rule} — 不是 enumRank,shellGate 秩无从派生`);
-    const table = { off: -1, classify: -1, always: -1 };
-    for (const [i, w] of tighten.order.entries()) {
-        if (!(w in table))
-            throw new Error(`SAFETY_MERGE_SPEC.shellGate 序里有本仓词表外的词:${w}`);
-        table[w] = i;
-    }
-    for (const [w, r] of Object.entries(table))
-        if (r < 0)
-            throw new Error(`SAFETY_MERGE_SPEC.shellGate 序缺词:${w}`);
-    return table;
-})();
-export function shellGateRank(word) {
-    const r = SHELL_GATE_RANK[word];
-    if (r === undefined)
-        throw new RangeError(`unknown shellGate word: ${word}`);
-    return r;
-}
 export function applyRuntimeGovernance(base, governance) {
     const marksOf = () => governance.askMarks ?? currentGovernanceAskMarks();
     const overrides = { ...autonomyOverrides(governance.autonomy) };
@@ -175,15 +151,8 @@ export function applyRuntimeGovernance(base, governance) {
         : undefined;
     if (governancePolicy !== undefined)
         overrides.toolPolicy = governancePolicy;
-    if (governance.manualModeShellGate !== undefined) {
-        const candidate = overrides.shellGate !== undefined && SHELL_GATE_RANK[overrides.shellGate] >= SHELL_GATE_RANK[governance.manualModeShellGate]
-            ? overrides.shellGate
-            : governance.manualModeShellGate;
-        if (SHELL_GATE_RANK[candidate] >= SHELL_GATE_RANK[base.shellGate ?? "off"])
-            overrides.shellGate = candidate;
-        else
-            delete overrides.shellGate;
-    }
+    if (governance.manualModeShellGate === "always")
+        overrides.shellGate = "always";
     if (overrides.shellGate === "always") {
         const shellObserver = createGovernanceShellGateMarkPolicy(marksOf);
         overrides.toolPolicy = governancePolicy === undefined ? shellObserver : combinePolicies(governancePolicy, shellObserver);

package/dist/sealed-key.d.ts

@@ -50,46 +50,6 @@ export interface SealedKeyCapability {
  *  omits the key entirely (present-iff this process built its custody store — see the route for the two meanings
  *  of absence). */
 export declare function projectSealedKeyCapability(face: SealedKeyPublicFace | undefined): SealedKeyCapability | undefined;
-/** Why a model's sealed key could not be unsealed (the poison-pill diagnosis, see SealedKeyPoison). CUSTODY failures only:
- *  a sealedApiKey that is malformed (alg other than the pinned v1 SEALED_KEY_ALG, non-base64 ciphertext) makes the whole
- *  catalog entry unavailable instead (S-704 `config.model_entry_invalid`, settings-schema `SealedApiKey` is the shape
- *  owner) — the former `unsupported_alg` reason was retired with that move (it could no longer be reached). */
-export type SealedKeyPoisonReason = "sealed_decrypt_failed" | "stale_ciphertext" | "no_key_store";
-/**
- * Poison-pill entry for the per-model key map (`config.modelApiKeys`): planted by applyEffective when
- * a model CARRIES `sealedApiKey` but the ciphertext cannot be unsealed. We deliberately do NOT drop
- * the model from the map — dropping made "sealed key broken" indistinguishable from "no per-model key
- * configured", and when the deployment also has a gateway MODEL_API_KEY the model's tasks silently
- * fell back onto the shared account (the exact hole the no-apiKeyEnv-fallback contract exists to
- * close). createKeyResolver turns this marker into a task-level `SealedKeyPoisonedError` — never
- * `undefined`, because undefined IS the "use the gateway key" semantic. Carries DIAGNOSIS only:
- * never the ciphertext, never any plaintext.
- */
-export interface SealedKeyPoison {
-    readonly sealedKeyPoison: true;
-    readonly publicKeyId: string;
-    readonly reason: SealedKeyPoisonReason;
-    /** Error CLASS of the unseal failure (e.g. "Error") — never the message (message text is logged
-     *  at plant time; keeping the object minimal keeps every serialization face trivially secret-free). */
-    readonly errKind?: string;
-    /** ISO timestamp of the apply that detected the failure. */
-    readonly at: string;
-}
-export declare function sealedKeyPoison(publicKeyId: string, reason: SealedKeyPoisonReason, errKind?: string): SealedKeyPoison;
-export declare function isSealedKeyPoison(v: unknown): v is SealedKeyPoison;
-/**
- * The task-level fail-loud face of a poison pill: thrown by the key resolver on EVERY brain call that
- * would otherwise authenticate this model, so a broken sealed key fails the task visibly (same family
- * as a rotation-leg auth failure) instead of silently burning the gateway account. Message carries the
- * sealed-failure marker (reason + publicKeyId + detection time) plus the operator fix — and nothing
- * secret (no ciphertext, no plaintext, by construction of SealedKeyPoison).
- */
-export declare class SealedKeyPoisonedError extends Error {
-    readonly publicKeyId: string;
-    readonly reason: SealedKeyPoisonReason;
-    readonly at: string;
-    constructor(modelName: string, poison: SealedKeyPoison);
-}
 /** Default id = fingerprint of the RAW public-key bytes: `exec-<sha256(pk)[0..12) hex>`.
  *  Deterministic → regenerating the id from the same key file is stable across boots. */
 export declare function deriveKeyId(publicKeyRaw: Uint8Array): string;

package/dist/sealed-key.js

@@ -17,26 +17,6 @@ export function projectSealedKeyCapability(face) {
         return undefined;
     return { alg: SEALED_KEY_ALG, publicKeyId: face.latest.publicKeyId, publicKey: face.latest.publicKey };
 }
-export function sealedKeyPoison(publicKeyId, reason, errKind) {
-    return { sealedKeyPoison: true, publicKeyId, reason, ...(errKind ? { errKind } : {}), at: new Date().toISOString() };
-}
-export function isSealedKeyPoison(v) {
-    return typeof v === "object" && v !== null && v.sealedKeyPoison === true;
-}
-export class SealedKeyPoisonedError extends Error {
-    publicKeyId;
-    reason;
-    at;
-    constructor(modelName, poison) {
-        super(`sealed api key for model "${modelName}" is unusable (${poison.reason}; publicKeyId "${poison.publicKeyId}"; detected ${poison.at}) — ` +
-            `refusing the gateway-key fallback. Fix custody: re-paste the key in the web UI (it seals against the newest registered public key), ` +
-            `or restore this host's private key for that id / complete the rotation so the ciphertext targets a held key.`);
-        this.name = "SealedKeyPoisonedError";
-        this.publicKeyId = poison.publicKeyId;
-        this.reason = poison.reason;
-        this.at = poison.at;
-    }
-}
 export function deriveKeyId(publicKeyRaw) {
     return `exec-${createHash("sha256").update(publicKeyRaw).digest("hex").slice(0, 12)}`;
 }

package/dist/server-secret-env.d.ts

@@ -69,9 +69,9 @@ export declare const CATALOG_SECRET_ENV_NAMES: ReadonlySet<string>;
  * 目录臂的计数恰好就是 core 形状规则的缺口读数;名单型旋钮臂只记前两臂都漏下的(今天 = 不在服务目录里的 `BAKE_ENV_ALLOW`)。
  * 各腿不直接调它 —— 经 {@link hostSubprocessEnv}(剥 + 放回 + 留痕一只口)。
  *
- * **只为宿主子进程组合**:子进程与本进程同平台 ⇒ core `scrubSecretEnv` 的平台尾参(core 7.33.6 #1159:git 的 env 配置记录按子进程的平台读 ——
- * POSIX 只认大写名,win32 大小写折叠)取缺省 `process.platform` 即对。本包跑在别的平台上的子进程(ssh / k8s / adb / e2b / docker 车道)的 env
- * 不经本函数:那些车道不继承本进程 env,只交调用方显式给的 env 与部署方点名的键(`E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV`,经 {@link allowlistedEnv})。
+ * **只为宿主子进程组合**。本包跑在别的平台上的子进程(ssh / k8s / adb / e2b / docker 车道)的 env 不经本函数:那些车道不继承本进程 env,只交
+ * 调用方显式给的 env 与部署方点名的键(`E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV`,经 {@link allowlistedEnv})。(core 7.33.6 #1159 的平台尾参随
+ * core 7.35.0 #1201 删除 —— git 的 env 配置族成了豁免族,不再有「按子进程平台读记录」这件事,S-877。)
  */
 export declare function scrubServerSecrets(env: NodeJS.ProcessEnv, findings: ServerSecretEnvFinding[]): NodeJS.ProcessEnv;
 /**
@@ -87,15 +87,14 @@ export declare function scrubServerSecrets(env: NodeJS.ProcessEnv, findings: Ser
  * 返回 `NodeJS.ProcessEnv` 形(值可能是 `undefined` 的键本来就不会进子进程);调用方显式要交的键(`LC_ALL`、`cfg.env` …)叠在它之上。
  * 调用时机 = 每次要交 env 时现算一次(`process.env` 在本仓是 boot 期输入,各次同值;计数因此是「每组合一次」)。
  *
- * 🔴 **git 的 env 配置组(`GIT_CONFIG_COUNT` + `GIT_CONFIG_KEY_<i>` / `GIT_CONFIG_VALUE_<i>`)只有 core 一只写手**(7.103.1:车PG 退役本层,车PK 提 core 7.33.6):
- * 一条配置(KEY + VALUE)一次判定;COUNT 以内被扣的一条**原位**换占位(`GIT_CONFIG_KEY_<i>=sema.withheld` / `GIT_CONFIG_VALUE_<i>=""`,git 读成一条没人用的
- * 配置)、不重排、COUNT 原样(#1160);COUNT 之外 / 没有 COUNT 的被扣条目整条不交;COUNT 按 git 的 `strtoul` 读(#1162);记录按子进程的平台读(#1159,见
- * {@link scrubServerSecrets})。本层 7.103.0 的「整组扣」与 7.103.1 中间态的「按 pair 扣留 + 重编号」(D-7)都已退役,本层不重判(同一语义面上不留第二只写手)。
- * 本仓按名两臂(目录 secret 名 / 名单型旋钮)不含这一族的名字(钉:`test/secret-env-git-config-pair.test.ts`「一只写手」格)。
- * 点名放回按名叠在 scrub 结果之上 ⇒ 放回一条被扣配置要把 KEY 与 VALUE 两只一并点名(只点一只 = 与另一只的占位半条配成一对)。
- * 🔴 **披露谓词 = 「这个名字没有按原样交给子进程」**(输入值 vs 输出值;core 7.33.6 pickup 注:「not handed on as written」)。被扣的记录成员在输出里
- * **仍在**(装着占位半条)⇒「组合结果里有没有这个名字」恒为有;点名放回的名字取回源值 ⇒ 与输入同值 ⇒ 不是剥除;占位半条恰与输入同值的成员(KEY 里
- * 带凭据、VALUE 本就是空串)子进程拿到的正是原值 ⇒ 也不披露。一只谓词盖住「剥掉」「换占位」「点名放回」三形,不按形分臂。
+ * 🔴 **git 的 env 配置族与代理变量一族只有 core 一只写手**:core 7.35.0 #1201(S-877,CC 2.1.280 形)起它们是 core 的**豁免族** ——
+ * `GIT_CONFIG_COUNT` / `GIT_CONFIG_PARAMETERS` / `GIT_CONFIG_KEY_<数字>` / `GIT_CONFIG_VALUE_<数字>`(大写)与 `http(s)_proxy` / `all_proxy` / `no_proxy` /
+ * `npm_config_*proxy` …(任意大小写),名与值都不读、**原样交出,凭据在内**(7.33.2–7.33.8 的逐条扣 / 原位占位 `sema.withheld` / 整只扣全部退役;
+ * 部署面:凭据不放本进程 env —— `docs/DEPLOY-PREREQS.md`)。本层 7.103.0 的「整组扣」与 7.103.1 中间态的「按 pair 扣留 + 重编号」(D-7)更早退役,
+ * 本层不重判(同一语义面上不留第二只写手;在下游把 core 的豁免改回扣 = 源头修复宪法禁止的改写)。本仓按名两臂(目录 secret 名 / 名单型旋钮)不含
+ * `GIT_CONFIG_` 这一族的名字(钉:`test/secret-env-git-config-pair.test.ts`「一只写手」格)。
+ * 🔴 **披露谓词 = 「这个名字没有按原样交给子进程」**(输入值 vs 输出值)。core 对一个变量的动作恒为「整只删」(从不改写值,#1201),点名放回的名字
+ * 取回源值 ⇒ 与输入同值 ⇒ 不是剥除。一只谓词盖住「剥掉」「点名放回」两形,不按形分臂(7.33.6–7.33.8 还有第三形「换占位」,随 #1201 消失)。
  */
 export declare function hostSubprocessEnv(o: {
     site: SecretEnvScrubSite;

package/dist/session-policy-wire.d.ts

@@ -61,15 +61,17 @@ export type ToolNameRuleField = {
  * ⚠️ **比准备阶段严一格**(方向安全,与 client-core 0.83.6 的 KL-157 同向):准备阶段对**本 run 名册里挂着**的
  * 同名工具放行(部署自己挂了一只叫 `Task` 的工具就不审计它),写口看不到将来哪一跑的名册 ⇒ 一律拒。
  * 受伤的是「部署自带与退役名同名的工具、又要在会话规则里点它」的形;出路 = 部署级工具策略(不经会话规则店)。
- * ⚠️ **过渡形**:core 已表态(#1156,7.34.1)把这两臂抽成一只导出纯函数并在会话规则店写口即拒 —— 到货后本函数
- * 换成调 core 那只(拒因原样透传),三份判定收成一份。
+ * ⚠️ **过渡形**:core 已表态(#1156)把这两臂抽成一只导出纯函数并在会话规则店写口即拒 —— 到货后本函数
+ * 换成调 core 那只(拒因原样透传),三份判定收成一份。**S-877 提货复核(core 7.35.0)**:#1156 **未随版**(发车帖 [ref] 逐字
+ * 「照 #1156 未随本版」);同版新导出的 `rosterToolName` / `ruleNamesOf`(#1194)是**别名归一**(一个名字在名册上落到哪只行的线名 /
+ * 一次调用可被规则拼成的名字集),不回答「这个名字会不会让准备阶段拒启」,不能替本函数 ⇒ 本函数照留,等 #1156。
  *
  * 🔴 **为什么不复用 `config.ts` 的 `findUnmatchableToolNames`**(本仓另一只按名字判的单点;读过实现后裁):两只回答的
  * 不是同一个问题。那一只问「部署名单里这条名字会不会**永远匹配不上**活工具」—— 它刻意豁免 `allow`(白名单匹配不上 =
  * fail-closed 且当场可见),并且拒两段 MCP 名 `mcp__srv`(一名两义)与 core 文法编不出的串。本函数问的是「引擎见到这条
  * 会话规则会不会**拒启**」:引擎准备阶段的名审计对 `allow` 桶照样抛(豁免它 = 放过一条砖化路径),对 `mcp__srv` 却
  * **不**抛(会话层自 core 5.55 / 5.56 起把它当整对端覆盖形真命中)。判据只能逐字跟 core 那两臂走,不能借另一只的口径。
- * 两只在「退役名」「无前缀 `__` 名」两臂上同源(都读 core 导出的同两件),7.34.1 提货时一并换调 core 的导出函数。
+ * 两只在「退役名」「无前缀 `__` 名」两臂上同源(都读 core 导出的同两件),#1156 到货的那一批一并换调 core 的导出函数。
  */
 export type LegacyToolName = {
     why: "retired";

package/dist/session-titler.d.ts

@@ -54,6 +54,17 @@ export interface SessionTitler {
 export declare const TITLE_MAX_CHARS = 80;
 /** Single line, control chars stripped, hard cap; surrounding quotes (a common LLM tic) trimmed. */
 export declare function sanitizeTitle(raw: string): string;
+/**
+ * S-236 ②(7.106.0,cli L-687)—— objective 里**用户自己写的**那部分:剥掉全部 `<system-reminder>…</system-reminder>` 块(跨行、
+ * 多块、夹在正文中间都剥;**未闭合**的块剥到末尾 —— 被截断的附件同样不是用户写的)后 trim。
+ *
+ * 为什么:壳把附件(技能清单一类的 `<system-reminder>` 块)拼在正文**之前**提交,标题器取前 {@link OBJECTIVE_SNIPPET_CHARS} 字
+ * 去起名 ⇒ 标题成了技能清单。判据只认这一个**字面标签**(CC 的附件信封),不按内容猜「像不像用户写的」——
+ * 正文里提到这个词的普通文字不是块,原样保留。剥完是空串 ⇒ 调用方走「空 objective 不起名」的既有臂。
+ * ⚠️ 只治这一类:S-236 原件(fresh `/decide` 腿把指路文本当 objective 提交)是另一类非用户文本,没有信封可剥,本函数刻意不加
+ * 按内容猜的第二臂(要么 fresh 腿传席,要么另立一臂 —— 候裁,见车RA 收车档)。
+ */
+export declare function userAuthoredObjectiveText(objective: string): string;
 export declare function buildTitlePrompt(objective: string): string;
 export declare function createSessionTitler(deps: SessionTitlerDeps): SessionTitler;
 //# sourceMappingURL=session-titler.d.ts.map

package/dist/session-titler.js

@@ -12,8 +12,12 @@ export function sanitizeTitle(raw) {
     const unquoted = oneLine.replace(/^["'「『]+/, "").replace(/["'」』]+$/, "").trim();
     return unquoted.length > TITLE_MAX_CHARS ? `${unquoted.slice(0, TITLE_MAX_CHARS - 1)}…` : unquoted;
 }
+export function userAuthoredObjectiveText(objective) {
+    return objective.replace(/<system-reminder>[\s\S]*?(?:<\/system-reminder>|$)/g, "").trim();
+}
 export function buildTitlePrompt(objective) {
-    const snippet = objective.length > OBJECTIVE_SNIPPET_CHARS ? `${objective.slice(0, OBJECTIVE_SNIPPET_CHARS)}…` : objective;
+    const text = userAuthoredObjectiveText(objective);
+    const snippet = text.length > OBJECTIVE_SNIPPET_CHARS ? `${text.slice(0, OBJECTIVE_SNIPPET_CHARS)}…` : text;
     const fenced = snippet.replace(/<(\/?)request>/gi, "<\u200b$1request>");
     return ("Write a short title (at most 8 words) summarizing the user request below. " +
         "Reply with ONLY the title on a single line — no quotes, no preamble. " +
@@ -34,7 +38,7 @@ export function createSessionTitler(deps) {
         .catch(() => ({ state: continueWord, unreadable: true }));
     return {
         maybeTitle(sessionId, objective, model) {
-            if (!sessionId || !objective.trim())
+            if (!sessionId || !userAuthoredObjectiveText(objective))
                 return;
             if (seen.has(sessionId))
                 return;

package/dist/sql-engine-posture.d.ts

@@ -11,7 +11,7 @@
  *
  * `sql-driver.ts` 的连接初始化在**每条池连接**上钉死这两件事并**回读复核**(`@contract txn.read-semantics`)。
  * 本模块把那份读数拿出来,一次推导两个读面:operator 面(`GET /v1/diagnostics/wiring` 的 `sqlEngine` 段,
- * 全量)与消费端面(`GET /v1/capabilities` 的 `sql` 位,窄投影)。两面同源 —— 「诊断页说悲观、能力位说
+ * 全量)与消费端面(`GET /v1/capabilities` 的 `store.sql` 位(7.106.0 起;此前顶层 `sql`,S-866 ①),窄投影)。两面同源 —— 「诊断页说悲观、能力位说
  * 乐观」在结构上不可能。
  *
  * ## 两条诚实纪律(与 memory-posture 同源)
@@ -27,7 +27,7 @@
 import { type SqlEngineFacts } from "./plugins/sql-driver.js";
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-/** 消费端窄投影(`GET /v1/capabilities` 的 `sql` 位)。`null` = 本部署没有 SQL 后端。 */
+/** 消费端窄投影(`GET /v1/capabilities` 的 `store.sql` 位;7.106.0 前是顶层 `sql`,S-866 ①)。`null` = 驱动此刻给不出事实 ⇒ `store.sql` 缺席。 */
 export interface SqlEngineCapability {
     engine: SqlEngineFacts["engine"];
     isolation: string;

package/dist/store-posture.d.ts

@@ -0,0 +1,53 @@
+/**
+ * S-866 ①(设计稿 v1.1 §2①)—— 「这台副本**真的在持久化吗**」的单一推导点:caps `store`、`/health.storeDegraded` / `durable:false`、
+ * gauge `store_backend_degraded` 三面读**同一只装配值**({@link StorePosture},`boot/stores.ts` 铸一次)。
+ *
+ * ## 病
+ * 7.105.0 及以前,店降级的痕迹是 gauge + `/health` 两位 + caps `sql:null` —— 而 `sql:null` 同时是「本来就没配 SQL」「local 文件店」
+ * 「降级到内存」「最近一次连接初始化被拒」四件事;调用方分不清「以为在持久化,其实在内存」这最坏的一形。
+ *
+ * ## 形
+ * `declared` = 运维的声明(`DB_BACKEND` 词,含缺省推导);`backend` = **装配出的**后端 kind(没装出后端 = `memory`);两者不等是合法的
+ * 形(`DB_BACKEND=pg` + `SESSION_BACKEND=memory` = 声明 pg、刻意不持久;auto 降级;缺省推导 local 起不来)—— 两位都上 wire,
+ * 由调用方自己读出落差。`degradedReason` present-iff 降级臂走过(按后端族定词,{@link storeDegradedReasonFor})。
+ * 顶层 `sql` 并入 `store.sql`(硬 breaking,零别名;对象逐字同形)。
+ */
+import { type DbBackendWord } from "./config-types.js";
+import type { StoreBackend } from "./plugins/store-backend.js";
+import type { SqlEngineFacts } from "./plugins/sql-driver.js";
+import { type SqlEngineCapability } from "./sql-engine-posture.js";
+/**
+ * 降级词闭集(**按后端族**,不按失败发生在哪一步 —— SQL 池懒连,连接失败第一次就出现在 `ensureSchema` 里,与 DDL 失败同一个调用,
+ * 按调用位置分不出「连不上」与「建表失败」):
+ *  · `db_unreachable` —— SQL 族(`mysql` / `pg`)在 `SESSION_BACKEND=auto` 下打不开(连接或建表);
+ *  · `local_unwritable` —— **缺省推导**的 local 文件店构造期失败(mkdir / 数据根锁 / 权限 / 只读挂载 / 磁盘满)。
+ */
+export declare const STORE_DEGRADED_REASONS: readonly ["db_unreachable", "local_unwritable"];
+export type StoreDegradedReason = (typeof STORE_DEGRADED_REASONS)[number];
+/** 降级臂按后端族定词(穷举 switch:词表加员 ⇒ 编译红)。`memory` 从不尝试打开后端,走不到降级臂 —— 到了就是装配缺陷,响亮抛。 */
+export declare function storeDegradedReasonFor(declared: DbBackendWord): StoreDegradedReason;
+/** 装配值(纯数据;`boot/stores.ts` 铸一次,gauge / `/health` / caps 三面同读)。 */
+export interface StorePosture {
+    readonly declared: DbBackendWord;
+    readonly backend: DbBackendWord;
+    readonly degradedReason?: StoreDegradedReason;
+}
+/** `build*`(纯数据)。`assembled` = 装配出的 `StoreBackend.kind`;缺席 = 没装出后端 ⇒ `memory`。 */
+export declare function buildStorePosture(a: {
+    readonly declared: DbBackendWord;
+    readonly assembled: StoreBackend["kind"] | undefined;
+    readonly degradedReason: StoreDegradedReason | undefined;
+}): StorePosture;
+/** caps `store` 的形。 */
+export interface StoreCapability {
+    readonly declared: DbBackendWord;
+    readonly backend: DbBackendWord;
+    readonly durable: boolean;
+    readonly degradedReason?: StoreDegradedReason;
+    /** 7.105.0 及以前的顶层 `sql` 对象,原样搬入(`{engine, isolation, txnMode}`)。present-iff `backend ∈ {mysql, pg}` ∧ 驱动此刻给得出
+     *  回读复核过的事实 —— 最近一次连接初始化被拒(S-137 ④)时驱动交 `null`,本键随之缺席(此前是顶层 `sql:null`)。 */
+    readonly sql?: SqlEngineCapability;
+}
+/** 装配值 → caps 投影(纯函数)。 */
+export declare function projectStoreCapability(posture: StorePosture, sqlFacts: SqlEngineFacts | null | undefined): StoreCapability;
+//# sourceMappingURL=store-posture.d.ts.map

package/dist/store-posture.js

@@ -0,0 +1,32 @@
+import {} from "./config-types.js";
+import { projectSqlEngineCapability } from "./sql-engine-posture.js";
+export const STORE_DEGRADED_REASONS = ["db_unreachable", "local_unwritable"];
+export function storeDegradedReasonFor(declared) {
+    switch (declared) {
+        case "mysql":
+        case "pg":
+            return "db_unreachable";
+        case "local":
+            return "local_unwritable";
+        case "memory":
+            throw new Error("store posture: DB_BACKEND=memory never opens a backend, so it cannot degrade — this is a wiring defect");
+        default: {
+            const unhandled = declared;
+            throw new Error(`store posture: unknown DB_BACKEND word ${String(unhandled)}`);
+        }
+    }
+}
+export function buildStorePosture(a) {
+    return { declared: a.declared, backend: a.assembled ?? "memory", ...(a.degradedReason !== undefined ? { degradedReason: a.degradedReason } : {}) };
+}
+export function projectStoreCapability(posture, sqlFacts) {
+    const sql = posture.backend === "mysql" || posture.backend === "pg" ? projectSqlEngineCapability(sqlFacts) : null;
+    return {
+        declared: posture.declared,
+        backend: posture.backend,
+        durable: posture.backend !== "memory",
+        ...(posture.degradedReason !== undefined ? { degradedReason: posture.degradedReason } : {}),
+        ...(sql !== null ? { sql } : {}),
+    };
+}
+//# sourceMappingURL=store-posture.js.map

package/dist/task-settings.d.ts

@@ -124,6 +124,12 @@ export declare function effectiveThinking(reasoningEffort: unknown, ultracode: b
  *  field is the explicit per-turn intent → it WINS over a bundle defaultMode). Creates a minimal settings object when
  *  no `body.settings` bundle was sent. The result flows through {@link applyTaskSettings} (tighten-only). */
 export declare function withPermissionMode(settings: ParsedTaskSettings | undefined, mode: SettingsPermissionMode): ParsedTaskSettings;
+/**
+ * 7.106.0 合并复审 X8(opus O-6)—— 请求**没有表态**模式时引擎实际跑的那个词。core 7.34.0 [ref]「Absent = `default`」
+ * (装树 `dist/core/runner/prepare-task.js` 的 `requested ?? "default"`)。只给**观测面**用(hook 载荷的 `permission_mode`,CC 恒带这个键):
+ * spec 过境点照旧不写键(`effectivePermissionMode` 缺席 ⇒ 不替调用方选 —— 那是引擎的默认,不是本仓的表态)。
+ */
+export declare const ENGINE_ABSENT_PERMISSION_MODE: "default";
 /**
  * [ref] §6-1 —— 本请求的**生效** permission mode,单点。优先序逐字同 {@link withPermissionMode}:
  * 顶层 `body.permissionMode`(本轮显式表态)赢过 bundle 的 `settings.permissions.defaultMode`;两处
@@ -137,51 +143,6 @@ export declare function withPermissionMode(settings: ParsedTaskSettings | undefi
 export declare function effectivePermissionMode(body: {
     permissionMode?: unknown;
 }, settings: ParsedTaskSettings | undefined): SettingsPermissionMode | undefined;
-/**
- * [ref] §2 —— 显式 permission mode → `TaskSpec.shellGate` 档位的**翻译表(单一真源)**。
- *
- *  · `bypassPermissions` ⇒ `"off"` —— CC `--dangerously-skip-permissions` 的对位裁定
- *    (与 fs-write 面的 bypass 臂两面归一,见 {@link deriveSettingsPolicy})。
- *  · `auto` ⇒ `"classify"` —— **[ref] §8 开口按施工期新披露亲裁改译**(原裁定字面是 off,
- *    §8 保留「core auto 分类器覆盖面有新披露时可独立再裁,表驱动一行」——新披露见下段):
- *
- *    ⚠️ **`auto` 这一行有一条待裁的开口([ref] §8 明列「core auto 分类器覆盖面有新披露时可独立再裁,
- *    表驱动一行」)。施工期交叉复审给出了那条新披露,已亲读安装包核实**:
- *      · core 只在**已经产生 `ask`** 之后才咨询分类器(`dist/core/hooks.js`:`if (input.autoMode &&
- *        decision.action === "ask" …)`);
- *      · 而 `shellGate:"off"` 下 core **不铸任何 shell 面的门**(`dist/core/runner/prepare-task.js` 的
- *        `shellGate === "off"` 臂反而发一条 `classification:"shell-gate-off"` 的 onError:「真可写 Bash 挂着
- *        却没有 shell 安全轴折叠」)。
- *    两条合起来:`auto` × off ⇒ Bash 既不产 ask、分类器也就永不被咨询 —— off 档下「筛选权交给分类器」
- *    不成立。故 auto 归 classify 组:分类器坐在 classify 产的 ask 之上,语义才真是「交给分类器」
- *    (良性只读命令由分类器自动放行,其余 ask;这正是 auto 模式的本义)。发车帖向 [ref] 裁定链披露此
- *    一行偏离;core auto 分类器若来日在 off 档下也有咨询点,可再裁回(表驱动一行)。
- *  · `default` / `acceptEdits` / `plan` ⇒ `"classify"` —— 这一档原先由壳无条件注入 `MANUAL_MODE_SHELL_GATE`
- *    供给(车道缺省走了 operator 通道),现在归位到表态轴。`plan` 本身 handsReadOnly(core 明写此档下
- *    shellGate 无效),给它 classify 纯为一致性。
- *
- * 🔴 **入参非可选**:缺席(无表态)不是这张表的一行 —— 它的语义是「不写这个键」,只能在调用点判。
- * 把它折进来会逼出一个 `undefined` 返回值,而那正是「写 off」与「不写」被混同的入口(core 的
- * 缺席默认是 off,但**写**一个 off 会成为 governance 的 base,与缺席不是同一件事)。
- *
- * 🔴 **闭集穷举表,无 default 臂**:五个模式词是封闭词表,新增一个模式而不更新本表
- * 是**编译错误**([ref] 的安全轴纪律:词表的未知项不许有静默兜底臂)。
- */
-export declare function shellGateForMode(effMode: SettingsPermissionMode): "off" | "classify";
-/**
- * [ref] —— 生效模式 → `TaskSpec.writeFace`(**写**面的 roots 容纳判断)。`"open"` = 工作区根之外也能写;
- * `undefined` = **不写这个键**(core 缺省 `"roots"`,与 7.77.0 及以前逐字节相同)。表逐字在
- * {@link MODE_ENGINE_FACES},裁定与硬边界写在 `resolve-spec.ts` 的写点上。
- *
- * 🔴 与 {@link shellGateForMode} 同律:入参非可选 —— 「表态缺席」不是这张表的一行(那是调用点判的
- * 「整个键都不写」),把它折进来就会逼出第二个 `undefined` 语义。
- */
-export declare function writeFaceForMode(effMode: SettingsPermissionMode): "open" | undefined;
-/**
- * [ref] ① —— 生效模式 → `TaskSpec.autoModeRequested`(auto **意图**座,CC 250「用户开」半场)。
- * `true` 只有 auto 一行;`undefined` = 不写键。表逐字在 {@link MODE_ENGINE_FACES}。
- */
-export declare function autoModeRequestedForMode(effMode: SettingsPermissionMode): true | undefined;
 /**
  * S-346 —— [ref] 技能清单预算两旋钮的**值域谓词**(一对具名单铸点)。
  *
@@ -262,6 +223,34 @@ export declare const MAX_SETTINGS_PERMISSION_RULES = 1000;
 export declare const MAX_SETTINGS_ENV_VARS = 256;
 export declare const MAX_SETTINGS_ENV_VALUE_CHARS = 32768;
 export declare const MAX_SETTINGS_ENV_KEY_CHARS = 256;
+/** 三桶(闭集;判据按此序逐桶判)。 */
+export declare const SETTINGS_PERMISSION_BUCKETS: readonly ["allow", "deny", "ask"];
+export type SettingsPermissionBucket = (typeof SETTINGS_PERMISSION_BUCKETS)[number];
+/** 拒因(闭集;wire 字段 `reason` 的全部词)。 */
+export declare const SETTINGS_PERMISSION_BUCKET_REFUSALS: readonly ["over_cap", "bad_entry"];
+export type SettingsPermissionBucketRefusal = (typeof SETTINGS_PERMISSION_BUCKET_REFUSALS)[number];
+/** 拒体的机读字段(按 `reason` 定形;原样进 wire 错误体 / `HttpError.extra`)。 */
+export type SettingsPermissionBucketIssueFields = {
+    readonly field: `settings.permissions.${SettingsPermissionBucket}`;
+    readonly reason: "over_cap";
+    readonly count: number;
+    readonly cap: number;
+} | {
+    readonly field: `settings.permissions.${SettingsPermissionBucket}`;
+    readonly reason: "bad_entry";
+    readonly index?: number;
+};
+/** 一次裁决的产物:wire 文案 + 机读字段。 */
+export interface SettingsPermissionBucketIssue {
+    readonly message: string;
+    readonly fields: SettingsPermissionBucketIssueFields;
+}
+/**
+ * 三桶的**唯一**判据(纯函数)。`perms` 不是对象 ⇒ 不判(那一形归「settings.permissions must be an object」那道门);桶缺席 / `null`
+ * ⇒ 不判(与 `permissions: null` 的「容器缺席」同一约定)。逐桶按 {@link SETTINGS_PERMISSION_BUCKETS} 的序:不是数组 ⇒ `bad_entry`(无
+ * `index`);超帽 ⇒ `over_cap`(先判,拒体有界);首个非串 / 空串项 ⇒ `bad_entry` + 它的下标。全合法 ⇒ `null`。
+ */
+export declare function settingsPermissionBucketIssue(perms: unknown): SettingsPermissionBucketIssue | null;
 /** 本 service 真正**消费**的 `settings` 顶层键 —— 闭集。每一个都有消费点:
  *  `env`/`hooks`/`model`/`outputStyle`/`permissions`/`ultracode` 与两个 `skillListing*` 在
  *  {@link parseTaskSettings};`webSearch` 在 `capabilities/scenarios.ts`(判决 `judgeRequestWebSearch`,单用户闸;形错在受理面 400,S-199)。

package/dist/task-settings.js

@@ -37,6 +37,7 @@ export function withPermissionMode(settings, mode) {
     const base = settings ?? {};
     return { ...base, permissions: { ...base.permissions, defaultMode: mode } };
 }
+export const ENGINE_ABSENT_PERMISSION_MODE = "default";
 export function effectivePermissionMode(body, settings) {
     const requested = coercePermissionMode(body.permissionMode) ?? settings?.permissions?.defaultMode;
     const kill = settings?.permissions?.disableAutoMode;
@@ -44,22 +45,6 @@ export function effectivePermissionMode(body, settings) {
         return "default";
     return requested;
 }
-export function shellGateForMode(effMode) {
-    return MODE_ENGINE_FACES[effMode].shellGate;
-}
-const MODE_ENGINE_FACES = {
-    bypassPermissions: { shellGate: "off", writeFace: "open", autoModeRequested: undefined },
-    auto: { shellGate: "classify", writeFace: undefined, autoModeRequested: true },
-    default: { shellGate: "classify", writeFace: undefined, autoModeRequested: undefined },
-    acceptEdits: { shellGate: "classify", writeFace: undefined, autoModeRequested: undefined },
-    plan: { shellGate: "classify", writeFace: undefined, autoModeRequested: undefined },
-};
-export function writeFaceForMode(effMode) {
-    return MODE_ENGINE_FACES[effMode].writeFace;
-}
-export function autoModeRequestedForMode(effMode) {
-    return MODE_ENGINE_FACES[effMode].autoModeRequested;
-}
 export function skillListingBudgetFractionOk(v) {
     return typeof v === "number" && Number.isFinite(v) && v > 0 && v <= 1;
 }
@@ -88,11 +73,44 @@ function cleanEnvMap(v) {
     }
     return n > 0 ? out : undefined;
 }
-function cleanStringArray(v) {
-    if (!Array.isArray(v))
-        return undefined;
-    const out = v.filter((x) => typeof x === "string" && x.length > 0).slice(0, MAX_SETTINGS_PERMISSION_RULES);
-    return out.length > 0 ? out : undefined;
+export const SETTINGS_PERMISSION_BUCKETS = ["allow", "deny", "ask"];
+export const SETTINGS_PERMISSION_BUCKET_REFUSALS = ["over_cap", "bad_entry"];
+function bucketIssueMessage(f) {
+    switch (f.reason) {
+        case "over_cap":
+            return (`${f.field} has ${f.count} entries — at most ${f.cap} are accepted. Refused rather than truncated: a truncated list silently drops the rules past the cap, ` +
+                `and a dropped deny / ask rule is a tightening that never happened. Merge rules into broader patterns or trim the list`);
+        case "bad_entry":
+            return f.index === undefined
+                ? `${f.field} must be an array of non-empty rule strings — refused rather than ignored, because an ignored list reads as "in effect" to the caller`
+                : `${f.field}[${f.index}] is not a non-empty rule string — every entry must be one. Refused rather than dropped, because a dropped entry reads as "in effect" to the caller`;
+    }
+}
+export function settingsPermissionBucketIssue(perms) {
+    if (perms === null || typeof perms !== "object" || Array.isArray(perms))
+        return null;
+    for (const bucket of SETTINGS_PERMISSION_BUCKETS) {
+        const v = perms[bucket];
+        if (v === undefined || v === null)
+            continue;
+        const field = `settings.permissions.${bucket}`;
+        let fields;
+        if (!Array.isArray(v))
+            fields = { field, reason: "bad_entry" };
+        else if (v.length > MAX_SETTINGS_PERMISSION_RULES)
+            fields = { field, reason: "over_cap", count: v.length, cap: MAX_SETTINGS_PERMISSION_RULES };
+        else {
+            const index = v.findIndex((x) => typeof x !== "string" || x.length === 0);
+            if (index >= 0)
+                fields = { field, reason: "bad_entry", index };
+        }
+        if (fields !== undefined)
+            return { message: bucketIssueMessage(fields), fields };
+    }
+    return null;
+}
+function acceptedRuleList(v) {
+    return Array.isArray(v) && v.length > 0 ? v.slice() : undefined;
 }
 export const TASK_SETTINGS_KEYS = ["env", "hooks", "model", "outputStyle", "permissions", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch"];
 export const TASK_SETTINGS_PERMISSION_KEYS = ["allow", "ask", "defaultMode", "deny", "disableAutoMode"];
@@ -154,9 +172,12 @@ export function parseTaskSettings(raw) {
     }
     if (perms !== null && typeof perms === "object" && !Array.isArray(perms)) {
         const p = perms;
-        const allow = cleanStringArray(p.allow);
-        const deny = cleanStringArray(p.deny);
-        const ask = cleanStringArray(p.ask);
+        const bucketsOk = settingsPermissionBucketIssue(p) === null;
+        if (!bucketsOk)
+            deferred.push("permissions");
+        const allow = bucketsOk ? acceptedRuleList(p.allow) : undefined;
+        const deny = bucketsOk ? acceptedRuleList(p.deny) : undefined;
+        const ask = bucketsOk ? acceptedRuleList(p.ask) : undefined;
         const defaultMode = coercePermissionModeStrict(p.defaultMode);
         const rawKill = p.disableAutoMode;
         const disableAutoMode = rawKill === "disable" || rawKill === true || rawKill === false ? rawKill : undefined;
@@ -348,7 +369,7 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
         }
         case "default":
         case "auto": {
-            const p = compose(fsWriteGate(false), createWorkflowAskPolicy(workflowGate?.isExempt));
+            const p = compose(createWorkflowAskPolicy(workflowGate?.isExempt));
             return p ? { toolPolicy: p } : {};
         }
         case "bypassPermissions":