@sema-agent/server 7.105.0 → 7.106.0

package/dist/tool-approval.d.ts

@@ -284,27 +284,6 @@ export interface ToolApprovalFrame {
      * ask」,治理策略产的与普通策略产的在这一个词上同形 ⇒ 顶替不了(逐字论证见 `governance-ask-marks.ts` 顶注)。
      */
     origin?: string;
-    /**
-     * **[ref] C3**(core 7.14.0;**ADDITIVE**,`"tool_approval"` only)—— `origin: "rule_store_unavailable"`
-     * 的**机制判别位**:持久规则车道这一次**读不下来的是哪一半**。core 闭二词
-     * (`RULE_STORE_UNREADABLE_KINDS`):`"store"` = 接上的规则店读不了(读失败 / 超时);`"call"` = 店读到了,
-     * 但**这条命令**按人的 deny/ask 行读不出来(收紧 lexer 的 `unreadable`:展开里含规则词、引号没闭、语法
-     * 错——具体那句在 `message` 里)。`AskRequest.ruleStoreUnreadable` 逐字透传。
-     *
-     * 🔴 **在场 ⇔ `origin === "rule_store_unavailable"`**(core 顶注逐字)。两词对审批人是两件事:`store`
-     * 指向「去看规则店 / 网络」,`call` 指向「这条命令的写法让规则判不了」——一个 origin 词对这两件事同形。
-     * 缺席 = 车道把店和这条命令都读通了,**或**本部署没接规则车道;消费端禁把缺席读成对规则店健康的断言。
-     *
-     * 🔴 **不枚举词表**(值形是 `string` 而不是本仓自铸的联合):词表单一属主在 core
-     * (`isRuleStoreUnreadable` 是它的成员判),抄一份会把 core 加的新词吞成缺席 —— 与 {@link origin} 逐字同规。
-     *
-     * 🔴 **echo-only,零消费**:策略自声明的值在 core 的**唯一**盖章点就被抹掉了,server 不重算、不再筛第二遍,
-     * 更不许据本键自铸第二张车道资格表 —— 同 `origin` / `denialLimitFallback` 两条顶注的同一条禁令。
-     *
-     * ⚰️ 本键的前任 `classifierUnavailable`(S-185 / [ref])随 core 7.14.0 [ref] **整族退役**:引擎那份事实改骑
-     * `GateDisposition.denied.cause`(`tool_end.gate` / `permissionDenied.gate`),ask 面自此没有这一位。
-     */
-    ruleStoreUnreadable?: string;
     /**
      * **[ref]**(core 7.19.0;**ADDITIVE**,`"tool_approval"` only)—— 这只**根外读** ask 的**清障目录**:
      * 把 `dir` 加进本会话的读目录(壳侧既有的 `/add-dir` 口),同一条调用就不会再问。
@@ -319,7 +298,7 @@ export interface ToolApprovalFrame {
      *
      * 🔴 **echo-only,零判读**:server 不从命令文本重推目录,也不复核它真不真能清掉这只 ask —— core 已经
      * 把提议的根放回读边界又走了一遍才递出来,下游再判一遍就是同一事实的第二个判官(与 `origin` /
-     * `ruleStoreUnreadable` / `denialLimitFallback` 三条顶注的同一条禁令)。
+     * `denialLimitFallback` 两条顶注的同一条禁令)。
      *
      * 🔴 **只此一面**:core 的负控逐字写着「the durable park row has no twin of this seat in this version」——
      * 一只 PARKED 的根外读 ask 渲的仍是单独那张确认卡。所以 `card_json` / 耐久面**没有**这一座,本仓也不
@@ -849,6 +828,10 @@ export type UnattendedPolicyRefusal = Extract<AskOutcome, {
  *  铸:park 政策的路由答 `"unavailable"`,deny 政策的 {@link UnattendedPolicyRefusal}。没有布尔臂(S-689:裸 `false`
  *  是人的拒绝,这个口从不替人说话)。 */
 export type UnattendedAskOutcome = Extract<AskOutcome, "unavailable"> | UnattendedPolicyRefusal;
+/** S-877 候裁 16:耐久会话授权店的读面(`src/plugins/approval-exemption-store.ts` 的 `has`,结构型 —— 协调器不值引店模块)。 */
+export interface SessionGrantReader {
+    has(sessionId: string, canonicalToolName: string): Promise<boolean>;
+}
 /**
  * [ref] 车3 刀 3b —— 「流内审批协议到底上不上场」的**单一谓词**(设计稿 §2.3 注入 / §2.4 能力面 /
  * §8.4 park 设施自检,三处同一份判据)。
@@ -1140,6 +1123,9 @@ export declare class ToolApprovalCoordinator {
      *  腿闭(`runWithContext` finally)。**纯观察面**:sink 自己吞写失败并 `recordFailOpen`,任何一次审计
      *  写都不得改变审批终局(店头注成文)。SQL 车道恒缺席(那里有真 ask 店)。 */
     private readonly askAudit;
+    /** S-877 候裁 16 → A:耐久会话授权店的**读面**(`/decide` 的 `remember:"session"` 写、本席读)。在场 ⇔ 部署有 store backend
+     *  (装配点 `boot/coordinators.ts`,与 `/decide` 写的是**同一只**店)。读口唯一 = {@link standingGrantSettles}。 */
+    private readonly sessionGrants;
     constructor(opts?: {
         ttlMs?: number;
         /** [ref](案A):零活流铸造的 ask 的窗(见 {@link unreachedTtlMs})。装配点在协议**上场**时才传
@@ -1167,6 +1153,8 @@ export declare class ToolApprovalCoordinator {
         parkTombstonePerPrincipalMax?: number;
         /** [ref] (c):local 车道审计 sink(见 {@link ToolApprovalCoordinator.askAudit})。 */
         askAudit?: ApprovalAskAuditSink;
+        /** S-877 候裁 16:耐久会话授权店的读面(见 {@link ToolApprovalCoordinator.sessionGrants})。 */
+        sessionGrants?: SessionGrantReader;
     });
     /**
      * [ref] R-13 C —— 「**无人可答**」这一类终局的**唯一**成形口(park 路由 vs deny 政策)。
@@ -1350,6 +1338,47 @@ export declare class ToolApprovalCoordinator {
      *  面)—— 把它混进本名单会让「同 askId 的重复本地注册」拿到裸 deny,而赢家拿的是 park 路由:同一条
      *  持久行、两种 live 终局。那一支改走 {@link settleSameAskIdParkRoute}。 */
     private settleVoidedSiblings;
+    /** [ref]/[ref]:本只 ask 的治理来源标(一次 peek,非消费式)。**出处决定判定**:按 `origin` 算 broker key(与写侧同一把),
+     *  投递到哪条连接不参与 —— 见 {@link AskOriginIdentity} 顶注。 */
+    private governanceForcedOf;
+    /**
+     * 🔴 **S-877 候裁 16 → A —— 站着的答案(会话授权)的唯一兑现口**(主会话裁定 2026-09-29;core 7.34.0 wire 段逐字指定的兑现位:
+     * 「a host approval seat that settles asks from a session grant reads it [`authoredBy`] to keep its hands off」)。
+     *
+     * **一条判据**:一只 ask 由会话授权代答 ⇔ ① 它是站着的答案退得掉的一问({@link standingAnswerMayRetire} —— 治理强制 /
+     * `requiresRealApproval` / `mandated` 三位的既有排除一字不动;运维「恒问人」的卡(`APPROVAL_NEVER_AUTO` / 耐久预算耗尽)
+     * 自 S-877 起盖部署出身 ⇒ core 盖 `mandated`,同落这一臂)∧ ② 有真会话 ∧ ③ 两只授权店任一命中:live `allow_session` 的
+     * 进程内表(按能力桶,[ref]② 修2)或耐久 `/decide` `remember:"session"` 的豁免店(按 canonical 工具名,`/decide` 写的同一只店;
+     * 读失败 ⇒ 不命中 = fail-closed,人多看一张卡而不是被静默代答)∧ ④ 行上没有与本地 peek 矛盾的出处({@link sessionGrantUncontestedByRow})。
+     *
+     * **两个读位、一只店、按问句的作者分**(收车档 ⑩ 16):本席兑现**引擎自装的问**(模式写门 / 形状层 —— core 7.34.0 起它们是引擎
+     * 自己的层、不读任何豁免,折叠 ask 赢 ⇒ 策略层探针对它们恒无效,codex F2);**本仓自己的问**(durable 名单门、workflow 问句门、
+     * acceptEdits 的 cwd 域写门)照旧在各自的层上读同一只店「不问」。为什么两处都要:子代经父约束链继承到的问到达祖先审批席时 core
+     * 盖 `mandated`(`ruleClearanceOf` 的 inheritedUnresolved / ancestorResolved 门),本席依约不退役 —— 只有策略层的「不问」够得着继承链
+     * (主会话裁定原想退役那三只探针,施工中被 test/parked-decide-leg.test.ts「[候裁② 修]remember 全链行为」证伪,收车档 ⑩ 16-⑤)。
+     * 本席的两个入口(`askBroadcast` 开头、窗 0 / 无活流身份席 {@link boundUnattendedAsk})都只调这一只。
+     */
+    private standingGrantSettles;
+    /** 耐久豁免店的一次读(fail-closed:读抛 **或超时** ⇒ 不命中 + warn)。只由 {@link standingGrantSettles} 调。
+     *  🔴 **有界**(codex 续车轮 F2):这一读排在呈卡 / 待决登记 / 审批计时器**之前**,一次黑洞化的店读会让整只 ask 连一个兜底都没有地
+     *  永久悬挂(与 R2-5 抓过的 `ensureAsk` 同病)。期限取 {@link DURABLE_CONVERGE_READ_TIMEOUT_MS}(只读复核,不是做事的调用);超时 ⇒
+     *  按未命中继续既有的呈卡 / 无人可答路径 —— 方向是人多看一张卡,不是被静默代答。迟到的真答案不追认(授权是「这一问要不要问」,
+     *  问已经发出去了)。 */
+    private durableGrantHas;
+    /**
+     * 🔴 **S-877 候裁 16 —— 窗 0 席**:本席**不呈卡**,但在报「无人可答」之前先问站着的答案。装配点 = 三条腿的 `windowZero` 席
+     * (sync `http/routes/tasks.ts`、bg `runs.ts`、resume `http/resume-legs.ts`)。修前三处是装配层的就地闭包 `() => unattendedAskOutcome(...)`
+     * —— 不读授权,引擎那一问(模式写门 / 形状层)在窗 0 部署上 remember 恒无效。改形后:授权命中 ⇒ `true`;否则逐字走
+     * {@link unattendedAskOutcome} 这**一个**政策口(五臂一处施加,[ref] R-13 C 不变)。
+     * parked 赎回腿的继承条目席**不**改:那条腿上到席的问全是继承问(core 盖 `mandated`),本席依约不退役,改了也兑现不了任何东西 ——
+     * 赎回腿上那类问的授权照旧由重建链里 durable 名单门的策略层探针兑现(锚 = 行的 root 会话)。复活子代**自己的**引擎问(模式写门 /
+     * 形状层)则经赎回腿铸的 execute ctx `onAsk` 落本席(身份 = 行的 root 会话,S-877 四续 ⑪,`parked-decide.ts` `approverSeatFor`)。
+     */
+    boundUnattendedAsk: (identity: {
+        owner: string | null;
+        taskId: string;
+        sessionId?: string;
+    }) => ((req: AskRequest) => Promise<AskOutcome>);
     /**
      * 🔴 session grant 短路前的**持久出处复核**([ref] 的 codex R1-[high] 补丁;[ref] 换判据)。
      *

package/dist/tool-approval.js

@@ -363,6 +363,7 @@ export class ToolApprovalCoordinator {
     parkTombstonePerPrincipalMax;
     parkedRedeem;
     askAudit;
+    sessionGrants;
     constructor(opts) {
         this.ruleConsent = opts?.ruleConsent;
         this.ruleScopeRootFor = opts?.ruleScopeRootFor;
@@ -379,6 +380,7 @@ export class ToolApprovalCoordinator {
         this.parkTombstoneTtlMs = opts?.parkTombstoneTtlMs ?? DEFAULT_PARK_TOMBSTONE_TTL_MS;
         this.parkTombstonePerPrincipalMax = opts?.parkTombstonePerPrincipalMax ?? DEFAULT_PARK_TOMBSTONE_PER_PRINCIPAL_MAX;
         this.askAudit = opts?.askAudit;
+        this.sessionGrants = opts?.sessionGrants;
     }
     unattendedOutcome(site) {
         let outcome;
@@ -696,6 +698,45 @@ export class ToolApprovalCoordinator {
                 entry.settle(false, "expired");
         }
     }
+    governanceForcedOf(origin, req) {
+        return (this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(origin.owner, origin.sessionId, origin.taskId))).isMarked(req.toolCallId);
+    }
+    async standingGrantSettles(origin, req, governanceForced) {
+        if (!standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true }))
+            return false;
+        const sessionId = origin.sessionId;
+        if (!sessionId)
+            return false;
+        const live = this.allowAllSessions.has(sessionAllowKey(origin.owner, sessionId, sessionAllowCategory(req.toolName)));
+        const durable = !live && (await this.durableGrantHas(sessionId, req.toolName));
+        if (!live && !durable)
+            return false;
+        if (!(await this.sessionGrantUncontestedByRow(origin, req)))
+            return false;
+        if (durable)
+            defaultLogger.info("approval_exempted", { sessionId, toolName: req.toolName, seat: "approval_seat" });
+        return true;
+    }
+    async durableGrantHas(sessionId, canonicalToolName) {
+        if (!this.sessionGrants)
+            return false;
+        try {
+            const hit = await this.withStoreDeadline(this.sessionGrants.has(sessionId, canonicalToolName), "sessionGrants.has(standing-grant)", DURABLE_CONVERGE_READ_TIMEOUT_MS);
+            return hit === true;
+        }
+        catch (err) {
+            defaultLogger.warn("session_grant_read_failed", { sessionId, toolName: canonicalToolName, error: String(err).slice(0, 200) });
+            return false;
+        }
+    }
+    boundUnattendedAsk = (identity) => {
+        return async (req) => {
+            const origin = { owner: identity.owner, taskId: identity.taskId, ...(identity.sessionId !== undefined ? { sessionId: identity.sessionId } : {}), legKey: "" };
+            if (await this.standingGrantSettles(origin, req, this.governanceForcedOf(origin, req)))
+                return true;
+            return this.unattendedAskOutcome({ taskId: identity.taskId, owner: identity.owner, toolName: req.toolName });
+        };
+    };
     async sessionGrantUncontestedByRow(origin, req) {
         if (!this.askStore)
             return true;
@@ -944,6 +985,9 @@ export class ToolApprovalCoordinator {
     async askBroadcast(origin, ctxs, req, signal) {
         if (signal?.aborted)
             return false;
+        const governanceForced = this.governanceForcedOf(origin, req);
+        if (await this.standingGrantSettles(origin, req, governanceForced))
+            return true;
         const aliveCtxs = ctxs.filter((c) => !c.abortSignal?.aborted);
         const reachability = aliveCtxs.length === 0 ? "unreached" : "reachable";
         if (reachability === "unreached") {
@@ -952,13 +996,6 @@ export class ToolApprovalCoordinator {
             }
         }
         const primary = aliveCtxs[0];
-        const governanceForced = (this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(origin.owner, origin.sessionId, origin.taskId))).isMarked(req.toolCallId);
-        if (standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true }) &&
-            origin.sessionId &&
-            this.allowAllSessions.has(sessionAllowKey(origin.owner, origin.sessionId, sessionAllowCategory(req.toolName))) &&
-            (await this.sessionGrantUncontestedByRow(origin, req))) {
-            return true;
-        }
         const releaseAdmission = this.admit(origin.taskId, origin.owner);
         if (!releaseAdmission) {
             defaultLogger.warn("approval admission gate: too many pending asks — routing to park", {
@@ -1009,7 +1046,6 @@ export class ToolApprovalCoordinator {
             ...(ruleLaneMaterial !== undefined ? { ruleOffers: ruleLaneMaterial.offers } : {}),
             ...((a) => (a !== undefined ? { ruleOffersAbsence: a } : {}))(readRuleOffersAbsence(req)),
             ...((f) => (f !== undefined ? { denialLimitFallback: f } : {}))(readDenialLimitFallback(req)),
-            ...(typeof req.ruleStoreUnreadable === "string" && req.ruleStoreUnreadable.length > 0 ? { ruleStoreUnreadable: req.ruleStoreUnreadable } : {}),
             ...((g) => (g !== undefined ? { readRootCandidate: g } : {}))(readReadRootCandidate(req)),
             ...((c) => (c !== undefined ? { probeCause: c } : {}))(readProbeCause(req)),
             ...((c) => (c !== undefined ? { ruleEvidence: c } : {}))(readRuleEvidence(req)),

package/dist/tool-declaration-http-status.d.ts

@@ -0,0 +1,12 @@
+export declare const TOOL_DECLARATION_HTTP_STATUS: {
+    readonly "config.tool_mount_denied": 400;
+    readonly "config.tool_roster_bound": 503;
+    readonly "config.tool_name_too_long": 503;
+    readonly "config.tool_contract_too_long": 503;
+    readonly "config.tool_schema_bound": 503;
+    readonly "config.tool_face_invalid": null;
+    readonly "config.tool_name_invalid": null;
+    readonly "config.egress_requires_write_effect": null;
+    readonly "config.reserved_tool_name": null;
+};
+//# sourceMappingURL=tool-declaration-http-status.d.ts.map

package/dist/tool-declaration-http-status.js

@@ -0,0 +1,12 @@
+export const TOOL_DECLARATION_HTTP_STATUS = {
+    "config.tool_mount_denied": 400,
+    "config.tool_roster_bound": 503,
+    "config.tool_name_too_long": 503,
+    "config.tool_contract_too_long": 503,
+    "config.tool_schema_bound": 503,
+    "config.tool_face_invalid": null,
+    "config.tool_name_invalid": null,
+    "config.egress_requires_write_effect": null,
+    "config.reserved_tool_name": null,
+};
+//# sourceMappingURL=tool-declaration-http-status.js.map

package/dist/trace/core-keyset-guard.d.ts

@@ -43,8 +43,8 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable" | "readRootCandidate" | "mandated" | "mandate";
-type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate";
+type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
 type AskFrameServerMinted = "type" | "approvalId" | "argsOmitted" | "outcome" | "governanceForced" | "expiresAtMs" | "expiresInMs" | "serverNowMs" | "parked" | "inputHasBidi";
@@ -133,19 +133,19 @@ type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTrace
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable" | "mandated" | "mandate";
-type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate";
+type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld" | "authoredBy";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
 type ParkArmKeys = keyof Extract<PendingAction, {
     kind: "tool_approval";
 }>;
 type ParkArmQueueProjected = "toolName" | "toolCallId" | "boundInputHash" | "ruleOffers" | "hasBidiControls" | keyof import("../approval-card.js").ParkRowFacts;
-type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "ruleStoreUnreadable";
+type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy";
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "approverPosture" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory";
 type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
@@ -163,7 +163,7 @@ type GateOutcomeProjected = "disposition" | "settlement" | "origin";
 type _GuardGateOutcome = AssertAllKeysHandled<Exclude<keyof GateOutcome, GateOutcomeProjected>>;
 type _GuardGateOutcomeReverse = AssertAllKeysHandled<Exclude<GateOutcomeProjected, keyof GateOutcome>>;
 type GateDispositionKeys = GateDisposition extends infer D ? (D extends object ? keyof D : never) : never;
-type GateDispositionProjected = "kind" | "deniedBy" | "cause" | "classifier";
+type GateDispositionProjected = "kind" | "deniedBy" | "cause" | "classifier" | "released" | "mode" | "askClass" | "classes";
 type _GuardGateDisposition = AssertAllKeysHandled<Exclude<GateDispositionKeys, GateDispositionProjected>>;
 type _GuardGateDispositionReverse = AssertAllKeysHandled<Exclude<GateDispositionProjected, GateDispositionKeys>>;
 type SettlementProjected = "kind" | "who" | "when" | "note";

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /**
  * S-690 —— **本仓自铸**的通告码与它们的受众(码 / 铸点 / 受众三者的属主都是本仓)。

package/dist/trace/engine-notice-wire.js

@@ -27,6 +27,11 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "approval.read_root_grant_rejected",
     "instructions.source_changed",
     "session.records_skipped",
+    "classifier.unavailable",
+    "config.permission_mode_unavailable",
+    "permission.ask_released_by_mode",
+    "permission.read_deny_unapplied",
+    "permission.rule_store_unavailable",
 ];
 export const SERVER_NOTICE_AUDIENCE = {
     "instructions.source_changed": "user",

package/dist/trace/project.d.ts

@@ -578,8 +578,9 @@ export declare function workspaceChangedEventData(ev: {
  *       两词:core 只看合成后的 caps deny 位,本仓分得出这个 false 是 center 下发的还是本地 env 写的)。
  *       ⚠️ **`settings_denied` 不折进 `denied`,它折进 `no_intent`**(codex 车BO r1 [medium] 验真后纠):
  *       settings 层的 kill-switch 折的是**模式**(`effectivePermissionMode`:auto → default),于是 resolve-spec
- *       阶段④ 压根不写意图座 `TaskSpec.autoModeRequested` ⇒ core 的武装谓词第一项就落空;而本地 env 腿折的是
- *       **caps**(`applyLocalAutoModeDeny`),模式不动、座照写 ⇒ core 才报 `denied`。两条腿在 manifest 上
+ *       阶段④ 写的 `TaskSpec.permissionMode` 是 `"default"`(S-877 前是「不写意图座 `autoModeRequested`」)⇒ core 的武装谓词第一项就落空;
+ *       而本地 env 腿折的是 **caps**(`applyLocalAutoModeDeny`),模式照写 `"auto"` ⇒ core 才报 `denied`(并按 `operator_deny` 折 default、发
+ *       `config.permission_mode_unavailable`)。两条腿在 manifest 上
  *       **分不开**,要分辨得读 `/v1/capabilities`。对照表与保鲜钉在 `test/wiring-manifest-projection.test.ts`
  *       的 147③ 节,分岔的行为面格在 `test/permission-mode-shell-gate-translation.test.ts`;
  *       本函数**只透传**,一个字都不换。

package/dist/trace/project.js

@@ -1,5 +1,5 @@
 import { admitProviderEcho, redactErrorMessage, redactModelText } from "../observability/run-terminal.js";
-import { MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, screenGateOutcome, TEAM_ROLES, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
+import { isAskClass, isAskOrigin, isPermissionMode, isPersistedRuleMandate, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, screenGateOutcome, TEAM_ROLES, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
 import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets, redactDeep } from "./redact.js";
@@ -103,6 +103,34 @@ export function screenedGate(v) {
         return undefined;
     }
 }
+function modeLedgerDefect(d) {
+    const classesOk = (v) => Array.isArray(v) && v.every((c) => isAskClass(c));
+    if (d.kind === "denied") {
+        if (d.mode !== undefined && !isPermissionMode(d.mode))
+            return "disposition.mode is outside the closed set";
+        if (d.askClass !== undefined && !isAskClass(d.askClass))
+            return "disposition.askClass is outside the closed set";
+        if (d.classes !== undefined && !classesOk(d.classes))
+            return "disposition.classes is not a list of ask classes";
+        return false;
+    }
+    if (d.released === undefined)
+        return false;
+    const r = d.released;
+    if (r === null || typeof r !== "object")
+        return "disposition.released is not an object";
+    const o = r;
+    if (!isPermissionMode(o.mode) || !isAskClass(o.askClass) || !classesOk(o.classes))
+        return "disposition.released.mode / askClass / classes is outside its closed set";
+    if (o.origin !== undefined && !isAskOrigin(o.origin))
+        return "disposition.released.origin is outside the closed set";
+    if (o.mandate !== undefined && !isPersistedRuleMandate(o.mandate))
+        return "disposition.released.mandate is outside the closed set";
+    if (o.reason !== undefined && !(typeof o.reason === "string" && Object.hasOwn(RELEASE_REASON_WORDS, o.reason)))
+        return "disposition.released.reason is outside the closed set";
+    return false;
+}
+const RELEASE_REASON_WORDS = { rule_unreadable: true };
 function screenedGateOrThrow(v) {
     if (v === null || typeof v !== "object") {
         if (v !== undefined)
@@ -121,6 +149,7 @@ function screenedGateOrThrow(v) {
         (d.classifier !== undefined && (d.classifier === null || typeof d.classifier !== "object") && "disposition.classifier is not an object") ||
         (classifierFallbackRaw !== undefined && (classifierFallbackRaw === null || typeof classifierFallbackRaw !== "object") && "disposition.classifier.fallback is not an object") ||
         (classifierFallbackRaw !== undefined && classifierFallbackRaw !== null && typeof classifierFallbackRaw === "object" && typeof classifierFallbackRaw.cause !== "string" && "disposition.classifier.fallback.cause is not a string") ||
+        modeLedgerDefect(d) ||
         (g.settlement !== undefined && (g.settlement === null || typeof g.settlement !== "object") && "settlement is not an object") ||
         (g.settlement !== undefined && g.settlement !== null && typeof g.settlement.kind !== "string" && "settlement.kind is not a string") ||
         (g.origin !== undefined && typeof g.origin !== "string" && "origin is not a string") ||
@@ -149,10 +178,29 @@ function screenedGateOrThrow(v) {
         recordFailOpen("server.trace.gate-outcome-defective", "settlement.who is not an object with a party in the closed set");
         return undefined;
     }
+    const rel = d.kind === "allowed" ? d.released : undefined;
+    const released = rel === undefined
+        ? undefined
+        : {
+            mode: rel.mode,
+            askClass: rel.askClass,
+            classes: [...rel.classes],
+            ...(rel.origin === undefined ? {} : { origin: rel.origin }),
+            ...(rel.mandate === undefined ? {} : { mandate: rel.mandate }),
+            ...(rel.reason === undefined ? {} : { reason: rel.reason }),
+        };
     return {
         disposition: d.kind === "denied"
-            ? { kind: "denied", deniedBy: d.deniedBy, ...(d.cause === undefined ? {} : { cause: d.cause }), ...(classifier === undefined ? {} : { classifier }) }
-            : { kind: "allowed", ...(classifier === undefined ? {} : { classifier }) },
+            ? {
+                kind: "denied",
+                deniedBy: d.deniedBy,
+                ...(d.cause === undefined ? {} : { cause: d.cause }),
+                ...(classifier === undefined ? {} : { classifier }),
+                ...(d.mode === undefined ? {} : { mode: d.mode }),
+                ...(d.askClass === undefined ? {} : { askClass: d.askClass }),
+                ...(d.classes === undefined ? {} : { classes: [...d.classes] }),
+            }
+            : { kind: "allowed", ...(classifier === undefined ? {} : { classifier }), ...(released === undefined ? {} : { released }) },
         ...(settlement === undefined ? {} : { settlement }),
         ...(g.origin === undefined ? {} : { origin: g.origin }),
     };

package/dist/trace/wire-projection-faces.d.ts

@@ -168,7 +168,7 @@ export declare const WIRE_PROJECTION_FACES: {
     readonly wiring_manifest_tenant: {
         readonly projector: "wiringManifestEventData";
         readonly coreType: `WiringManifest & ${string}`;
-        readonly excluded: readonly ["governance", "configFingerprint", "autoConsolidation", "readDeny", "peerPresence"];
+        readonly excluded: readonly ["governance", "configFingerprint", "autoConsolidation", "readDeny", "peerPresence", "permissionMode"];
         readonly unwrapped: readonly ["manifest"];
         readonly minted: readonly [];
     };

package/dist/trace/wire-projection-faces.js

@@ -40,7 +40,7 @@ export const WIRE_PROJECTION_FACES = {
     wiring_manifest_tenant: {
         projector: "wiringManifestEventData",
         coreType: `WiringManifest & ${arm("wiring_manifest")}`,
-        excluded: ["governance", "configFingerprint", "autoConsolidation", "readDeny", "peerPresence"],
+        excluded: ["governance", "configFingerprint", "autoConsolidation", "readDeny", "peerPresence", "permissionMode"],
         unwrapped: ["manifest"],
         minted: [],
     },

package/dist/unattended-permission-mode.d.ts

@@ -0,0 +1,110 @@
+/**
+ * S-877 候裁 15 → B(主会话裁定 2026-09-29,收车档 ⑩)—— `UNATTENDED_PERMISSION_MODE`:**无人值守腿的模式,运维一处表态**。
+ *
+ * ## 规则(一句)
+ * 本仓**自己铸** spec、**没有调用方**能在请求上表态模式、也**没有审批席**的腿 —— leader worker(`src/leader/wire.ts`
+ * provisionWorker 两车道)、leader 的两只修复腿(集成沙箱修复 `mkRepair`、模块门修复 `runModuleGate` / 单代理修复环
+ * `attachRepairLoopDeps`)、run-local(`src/run-local.ts`,一次性 CLI)—— 它们的 `TaskSpec.permissionMode` 由本旋钮给,
+ * 经 {@link unattendedPermissionMode} 这**一只**读函数取值,各腿不各读 config、不各写默认。
+ *
+ * ## 为什么要有它(对 v7.105.0 回归的修,codex 对抗复审 F1 [high] 亲核成立)
+ * core 7.34.0 [ref]「Absent = `default`」:不带 `permissionMode` 的 spec 按 `default` 跑 —— 模式写门对每一次写先问、
+ * 形状层对非只读 shell 先问。上面三类腿**没有人**能答那一问(leader 的 Runner 不接 `onAsk`,零名单部署也不给 durable 席;
+ * run-local 无 TTY 时同形)⇒ headless 当场拒:worker `completed`、零写入。7.105.0 上这些腿不带模式也不问
+ * (缺席臂只给 base、`shellGate` 不写)。core 同段逐字给出路:「A library embedder that writes files with no approver
+ * now declares `permissionMode: "acceptEdits"` … or `"bypassPermissions"` … or wires an approver」——本仓对自己铸的
+ * 那几条 spec 就是那个 embedder。
+ *
+ * ## 三问
+ *  · **谁需要**:用 leader / run-local 的部署(零审批名单是常态)—— 缺省值必须等于 7.105.0 的行为,否则升级即断。
+ *  · **谁受伤**:想让无人值守腿更严的运维 —— **补偿** = 把旋钮设成 `acceptEdits`(根内写不问、非只读命令仍问 ⇒ 无人可答即拒)
+ *    / `default` / `dontAsk`(一切会问的都拒)/ `plan`。部署的审批名单(`APPROVAL_REQUIRE` 等)与治理层的问(运维强制、ask 规则、
+ *    hook)在任何一个词下都**照问**:bypassPermissions 只放行「普通」一类(core 7.34.0 [ref] 仲裁表,本仓不重推)。
+ *  · **什么补偿**:缺省 = `bypassPermissions` —— 写门 / 形状层与 7.105.0 同(不问);词表外的值起服拒启([ref],不静默回缺省)。
+ *    候裁 18 → D:缺省 bypass 会释放写保护 ⇒ 本腿把写保护从问改成拒({@link createUnattendedWriteProtectionPolicy});另六类释放 = 相对 7.105.0 的宽化,
+ *    如实披露(见那只函数的「射程外」)。**过渡形**:core 7.37.0(S-906)后退成 `default` + 按类作答的 onAsk,旋钮硬删(拒启点名)。
+ *
+ * ## 写面:本旋钮只给模式的**仲裁**,不给 bypassPermissions 在 core 模式表里的**写面 open**
+ * core 7.34.0 起 `modePolicyOf("bypassPermissions").writeFace === "open"`(工作区根之外也能写)。7.105.0 上这几条腿**没有模式**,
+ * 写面恒是引擎缺省 `"roots"`。所以 {@link buildUnattendedLegSpec} 同时在任务席写 `writeFace: "roots"`(core 容纳面解析序:
+ * 显式任务席在模式那一行**之前**,`dist/tools/fs/containment-face.d.ts` resolveContainmentFace 第 3 / 3′ 行)—— 缺省与 7.105.0
+ * **逐字**同形,运维把旋钮设成任何词也不会顺手拿到根外写面(那是 HTTP 腿上 `TASK_WRITE_FACE_ESCALATION` 管的另一件事,
+ * S-591;这几条腿不是请求,不经那道门)。⚠️ 这一格是按裁定的**意图**(「= 7.105.0 行为」)施工、比裁定字面多出的一半,
+ * 收车档 ⑩ 单列,主会话可翻。
+ *
+ * ## 射程外(成文)
+ *  · HTTP 腿(`POST /v1/tasks|runs`):模式在请求上(`permissionMode` / `settings.permissions.defaultMode`),缺席 = core `default`
+ *    原样过境(候裁 5 裁 A)—— 那里有调用方能表态,本旋钮不参与。
+ *  · leader 的 planner 路由(无手 Runner,没有写 / shell 可问)不读本旋钮。
+ *  · 中心下发 `RuntimeCaps.bypassPermissions === false` 时 core 把 bypass 折回 `default` 并发 `config.permission_mode_unavailable`
+ *    —— 组织级拒优先。本仓今天不写这一位([ref] 未闭环),故这条今天只在 core 侧可达。
+ */
+import { type PermissionMode, type RunnerDeps, type TaskSpec, type ToolPolicy } from "@sema-agent/core";
+/** 旋钮的出厂值(主会话裁定候裁 15 B / 18 D)。写面由 {@link buildUnattendedLegSpec} 钉 roots;写保护由 {@link createUnattendedWriteProtectionPolicy} 改拒。 */
+export declare const UNATTENDED_PERMISSION_MODE_DEFAULT: "bypassPermissions";
+/** 解析结果:值 + 它从哪来(boot 一行 `unattended_permission_mode` 的两个字段)。 */
+export interface UnattendedPermissionModeSetting {
+    readonly value: PermissionMode;
+    readonly source: "env" | "default";
+}
+/**
+ * `UNATTENDED_PERMISSION_MODE` 的**唯一**解析口。词表 = core `PERMISSION_MODES` 本尊(不手抄 —— core 加词本口随之受理,
+ * 减词本口随之拒启);两侧空白裁掉后**逐字**比较(不折大小写:`Default` / `BYPASS` 落拒启臂)。
+ * 未设 / 空串 ⇒ 出厂值,来源 `default`;词表外 ⇒ **拒启**,拒因点名旋钮与全部合法词([ref]:安全轴旋钮不许「以为设了其实没设」)。
+ */
+export declare function parseUnattendedPermissionMode(raw: string | undefined): UnattendedPermissionModeSetting;
+/** 三类无人值守腿的**唯一**读函数(见模块头注「规则」)。 */
+export declare function unattendedPermissionMode(config: {
+    readonly unattendedPermissionMode: PermissionMode;
+}): PermissionMode;
+/** 无人值守腿铸进 spec 的两键(纯数据 ⇒ `build*`):模式 = 旋钮值;写面 = `"roots"`(理由见模块头注「写面」)。 */
+export declare function buildUnattendedLegSpec(mode: PermissionMode): Required<Pick<TaskSpec, "permissionMode" | "writeFace">>;
+/**
+ * 🔴 **S-877 候裁 18 → D(主会话续裁 2026-09-29)—— 无审批席的腿上,写保护从「问」改成「拒」**。
+ *
+ * **病**(codex 续车轮 R2-F1):core `MODE_ARBITRATION` 里 `bypassPermissions` 释放 `write_protection` 一类(`bypassImmune:false`)⇒ 旋钮缺省下写保护表里的
+ * 目标零询问放行;7.105.0 这些腿无模式 ⇒ 写保护是一问 ⇒ 无人可答 ⇒ 拒。core 7.35 没有「放普通问、留保护问」的模式,也没有限定模式可释放类的座。
+ *
+ * **规则(一条)**:本腿的模式**会释放**写保护一问时(读 core 仲裁本尊 `arbitrateByMode`,不手抄模式词),把**本腿引擎判官用的同一张写保护表**
+ * (`runnerSeats` = 构造本腿 Runner 的那份 deps 的两只座 {@link UnattendedLegRunnerSeats};`writeProtectedPaths` 缺席 = core 源表 `WRITE_PROTECTED_DEFAULT_TABLE`)经 core 的
+ * `compileWriteProtection` 编成判官,每一行铸成一条 **core 路径拒行**(`ToolPolicy.pathDenyRules`,`faces:["write"]`)—— 引擎的写面把它们并进本腿的拒表:
+ * 写工具的路径解析与 shell 站(重定向 / `tee` / `sed -i` / `cp`·`mv`·`touch` 操作数)都按拒表拒,模式**不释放拒**。**路径匹配全在 core**:每行的
+ * `reaches` 就是判官自己的 `matchPath`(同一只折叠、同一只数据根放行 —— `dataRoot` 与引擎判官同源:本腿 Runner 的 `memoryEngineDir`),本仓不写一个字的
+ * 路径比较。模式不释放写保护(`default` / `acceptEdits` / `plan` / `auto` / `dontAsk`)⇒ 不铸(那一问照旧问,有席的腿上人能答 —— run-local 有 TTY 时)。
+ *
+ * **射程外**(如实,收车档 ⑩ 候裁 18):缺省 bypass 还释放 `probe` / `tool_marks_mcp` / `tool_marks_a2a` / `transcript_write` / `rule_unreadable` /
+ * `artifact_shared_read` 六类(core 对它们没有「拒」的座),相对 7.105.0 是宽化 —— CHANGELOG「谁受伤」与 MIGRATION 写明,补偿 = 旋钮 `acceptEdits` / `default`。
+ * **过渡形**:core 7.37.0(S-906,`AskRequest.askClass?` / `classes?` 到货)后本仓改成 `default` 模式 + fail-closed 按类作答的 `onAsk`,本座与旋钮一并硬删。
+ * **续跑**(codex r3 F1):本层是活闭包、进不了 checkpoint,而 core 续跑在 spec 不说模式时取 checkpoint 记下的模式 ⇒ durable 续跑必须重挂整条腿 ——
+ * leader worker 的续跑上下文带 `CheckpointCtx.unattendedLeg`,续跑家族据此让 `resolveSpec` 在全部折叠之后调 {@link createUnattendedLeg} / {@link withUnattendedLeg}。
+ * **已知过拒**(codex r3 F2,fail-closed 方向,随过渡形退役):core 的路径拒座在 shell 站把 `cp` 的**源**操作数也按写目标判(CC 同形,cli280.js:216993
+ * `cp:"write"`),引擎写保护判官只判真写目标 ⇒ 从写保护目标复制出来在本层下被拒、7.105.0 上照跑。本仓不补路径比较(那是第二个判官),特征化钉在
+ * test/run-local.test.ts「🚧 codex r3 F2」。
+ * **附带效果**(S-877 四续 ⑫b,随过渡形退役):本层只能是一只 `ToolPolicy`(路径拒座挂在策略上,`check` 必填 —— 这里恒 `allow`),原先没有 toolPolicy
+ * 的腿因此被引擎读成「有策略层」:系统提示多 `# Execution environment` 一块、UNGATED 告警不再发。7.35.2 上表达不了「只供拒行、不算策略层」;
+ * 特征化钉在 test/unattended-permission-mode.test.ts「🚧 四续 ⑫b」。
+ *
+ * 返回 `undefined` = 本腿不需要这一层(模式不释放写保护,或运维把表清空 `[]`)。活对象(带判官闭包)⇒ `create*`。
+ */
+export declare function createUnattendedWriteProtectionPolicy(mode: PermissionMode, runnerSeats: UnattendedLegRunnerSeats): ToolPolicy | undefined;
+/** 无人值守腿的全部铸件:模式 + 写面(纯数据)与写保护拒层(活对象,可缺席)。由 {@link createUnattendedLeg} 铸、{@link withUnattendedLeg} 并进 spec。 */
+export interface UnattendedLeg {
+    readonly spec: Required<Pick<TaskSpec, "permissionMode" | "writeFace">>;
+    readonly writeProtection: ToolPolicy | undefined;
+}
+/**
+ * 引擎写保护判官读的两只 Runner 座(`RunnerDeps` 的同名切片):表(`writeProtectedPaths`,缺席 = core 源表)与数据根放行(`memoryEngineDir`,缺席 = 引擎缺省)。
+ * 调用方递**构造本腿 Runner 的那一份** deps(或它的展开源)—— 表与根从哪来、根要不要在,都由那份 deps 说了算,腿的接线处不再单独读任何一只坐标
+ * (本模块是唯一读者;S-877 四续:接线处各读一份就是「两边同一张表、同一个根」这句话的第二、三个写者)。
+ */
+export type UnattendedLegRunnerSeats = Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir">;
+/** 三处无人值守腿(leader worker / 修复腿 / run-local)与续跑重挂的**唯一**铸点:`mode` 取 {@link unattendedPermissionMode},`runnerSeats` = 本腿 Runner 的 deps
+ *  (引擎写保护判官与本层拒行同一张表、同一个数据根)。 */
+export declare function createUnattendedLeg(mode: PermissionMode, runnerSeats: UnattendedLegRunnerSeats): UnattendedLeg;
+/**
+ * 把无人值守腿并进一条 spec —— 三处腿的**唯一**合并口:两键覆盖(本腿的模式与写面由旋钮说了算),写保护拒层与 spec 已有的 `toolPolicy` **合成**
+ * (`combinePolicies`,deny-wins,携带 `pathDenyRules`)而不是覆盖(leader worker 的 durable 名单门、run-local 的治理链都在那里)。
+ * 调用点必须在 spec 其余键(含治理折叠)**之后**调它,否则后铸的 `toolPolicy` 会把拒层盖掉。
+ */
+export declare function withUnattendedLeg<S extends Partial<TaskSpec>>(spec: S, leg: UnattendedLeg): S & Required<Pick<TaskSpec, "permissionMode" | "writeFace">>;
+//# sourceMappingURL=unattended-permission-mode.d.ts.map

package/dist/unattended-permission-mode.js

@@ -0,0 +1,65 @@
+import { ASK_CLASSES, PERMISSION_MODES, arbitrateByMode, combinePolicies, compileWriteProtection, foldArbitrationRow } from "@sema-agent/core";
+import { recordFailOpen } from "./observability/fail-open.js";
+export const UNATTENDED_PERMISSION_MODE_DEFAULT = "bypassPermissions";
+export function parseUnattendedPermissionMode(raw) {
+    const trimmed = (raw ?? "").trim();
+    if (trimmed === "")
+        return { value: UNATTENDED_PERMISSION_MODE_DEFAULT, source: "default" };
+    const word = PERMISSION_MODES.find((m) => m === trimmed);
+    if (word === undefined) {
+        throw new Error(`env UNATTENDED_PERMISSION_MODE="${trimmed.slice(0, 120)}" is not a permission mode — use one of: ${PERMISSION_MODES.join(", ")} ` +
+            `(or leave it unset for the default "${UNATTENDED_PERMISSION_MODE_DEFAULT}", which keeps the unattended legs — leader workers / repairs and run-local — acting as they did before server 7.106.0). ` +
+            `The word is matched EXACTLY (surrounding whitespace trimmed, no case folding). ` +
+            `Refusing to boot rather than treating it as unset: that would run those legs under a mode the operator did not choose`);
+    }
+    return { value: word, source: "env" };
+}
+export function unattendedPermissionMode(config) {
+    return config.unattendedPermissionMode;
+}
+export function buildUnattendedLegSpec(mode) {
+    return { permissionMode: mode, writeFace: "roots" };
+}
+export function createUnattendedWriteProtectionPolicy(mode, runnerSeats) {
+    if (!modeReleases(mode, "write_protection"))
+        return undefined;
+    const dataRoot = runnerSeats.memoryEngineDir;
+    const judge = compileWriteProtection(runnerSeats.writeProtectedPaths, dataRoot !== undefined ? { dataRoot } : undefined);
+    if (judge === undefined)
+        return undefined;
+    const pathDenyRules = judge.rows.map((row) => ({
+        rule: `WriteProtected(${row.name})`,
+        tool: "Edit",
+        pattern: row.name,
+        faces: ["write"],
+        reaches: (absolutePath) => judge.matchPath(absolutePath)?.name === row.name,
+    }));
+    return {
+        check: () => ({ action: "allow" }),
+        pathDenyRules,
+    };
+}
+function modeReleases(mode, askClass) {
+    const classes = new Set([askClass]);
+    return arbitrateByMode(mode, { classes, askClass, row: foldArbitrationRow(classes) }).kind === "released";
+}
+const INTENDED_RELEASES = new Set(["ordinary", "mode"]);
+function releasedProtectiveClasses(mode) {
+    return ASK_CLASSES.filter((c) => !INTENDED_RELEASES.has(c) && c !== "write_protection" && modeReleases(mode, c));
+}
+const RELEASED_PROTECTIVE_ASKS_TAG = "server.unattended-leg.mode-releases-protective-asks";
+export function createUnattendedLeg(mode, runnerSeats) {
+    const debt = releasedProtectiveClasses(mode);
+    if (debt.length > 0)
+        recordFailOpen(RELEASED_PROTECTIVE_ASKS_TAG, `mode=${mode} released=${debt.join(",")}`);
+    return { spec: buildUnattendedLegSpec(mode), writeProtection: createUnattendedWriteProtectionPolicy(mode, runnerSeats) };
+}
+export function withUnattendedLeg(spec, leg) {
+    const wp = leg.writeProtection;
+    return {
+        ...spec,
+        ...leg.spec,
+        ...(wp !== undefined ? { toolPolicy: spec.toolPolicy !== undefined ? combinePolicies(spec.toolPolicy, wp) : wp } : {}),
+    };
+}
+//# sourceMappingURL=unattended-permission-mode.js.map