@sema-agent/server 7.112.0 → 7.114.0

package/dist/execution-lane-caps.js

@@ -1,4 +1,5 @@
 import { homedir } from "node:os";
+import { EXECUTION_LANE_WORDS as DECLARABLE_LANE_WORDS, EXECUTION_LANES } from "@sema-agent/settings-schema/execution-lanes";
 const NO = "unsupported";
 const YES = "supported";
 const SU = "single-user-only";
@@ -38,7 +39,7 @@ export function executionLaneCaps(lane) {
                 hostFilePlane: YES,
                 coreRemoteExecutionEnv: YES,
                 canonicalPathAuthority: YES,
-                tenantSeparation: SU,
+                tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
         case "e2b":
             return {
@@ -56,7 +57,7 @@ export function executionLaneCaps(lane) {
                 hostFilePlane: NO,
                 coreRemoteExecutionEnv: YES,
                 canonicalPathAuthority: NO,
-                tenantSeparation: YES,
+                tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
         case "k8s":
             return {
@@ -74,7 +75,7 @@ export function executionLaneCaps(lane) {
                 hostFilePlane: NO,
                 coreRemoteExecutionEnv: YES,
                 canonicalPathAuthority: YES,
-                tenantSeparation: YES,
+                tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
         case "ssh":
             return {
@@ -92,7 +93,7 @@ export function executionLaneCaps(lane) {
                 hostFilePlane: NO,
                 coreRemoteExecutionEnv: YES,
                 canonicalPathAuthority: YES,
-                tenantSeparation: SU,
+                tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
         case "adb":
             return {
@@ -110,7 +111,7 @@ export function executionLaneCaps(lane) {
                 hostFilePlane: NO,
                 coreRemoteExecutionEnv: YES,
                 canonicalPathAuthority: YES,
-                tenantSeparation: SU,
+                tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
         case "local-docker":
             return {
@@ -128,7 +129,7 @@ export function executionLaneCaps(lane) {
                 hostFilePlane: NO,
                 coreRemoteExecutionEnv: YES,
                 canonicalPathAuthority: NO,
-                tenantSeparation: YES,
+                tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
         case "device":
             return {
@@ -146,25 +147,52 @@ export function executionLaneCaps(lane) {
                 hostFilePlane: NO,
                 coreRemoteExecutionEnv: YES,
                 canonicalPathAuthority: YES,
-                tenantSeparation: YES,
+                tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
     }
 }
-const EXECUTION_LANE_WORDS = {
-    "in-process": true,
-    host: true,
-    e2b: true,
-    k8s: true,
-    ssh: true,
-    adb: true,
-    "local-docker": true,
-    device: true,
-};
+export const ALL_EXECUTION_LANES = Object.freeze(["in-process", ...DECLARABLE_LANE_WORDS]);
+const EXECUTION_LANE_SET = new Set(ALL_EXECUTION_LANES);
 export function isExecutionLane(word) {
-    return Object.hasOwn(EXECUTION_LANE_WORDS, word);
+    return EXECUTION_LANE_SET.has(word);
+}
+export const REMOTE_EXEC_PROVIDER_WORDS = Object.freeze([...DECLARABLE_LANE_WORDS]);
+const LANE_ROWS = (() => {
+    const rows = new Map();
+    for (const row of EXECUTION_LANES) {
+        if (rows.has(row.lane))
+            throw new Error(`@sema-agent/settings-schema EXECUTION_LANES lists lane "${row.lane}" twice — the lane table is the single source; refusing to guess which row is meant`);
+        rows.set(row.lane, row);
+    }
+    const missing = DECLARABLE_LANE_WORDS.filter((lane) => !rows.has(lane));
+    if (missing.length > 0)
+        throw new Error(`@sema-agent/settings-schema EXECUTION_LANES has no row for lane(s) ${missing.join(", ")} — the lane table is the single source; refusing to start with a lane whose required env / tenant separation is unknown`);
+    return rows;
+})();
+export function executionLaneRow(lane) {
+    const row = LANE_ROWS.get(lane);
+    if (row === undefined)
+        throw new Error(`execution lane "${lane}" has no row in the settings-schema lane table (load-time completeness check was bypassed)`);
+    return row;
+}
+export function laneRequiredEnv(lane) {
+    const row = executionLaneRow(lane);
+    return [...row.requiredEnv, ...row.requiredSecretEnv];
+}
+export function executionLaneRequiredRefusal(deployment) {
+    if (!deployment.requireExecutionLane || executionLaneOf(deployment.remoteExec?.provider) !== "in-process")
+        return undefined;
+    return (`REQUIRE_EXECUTION_LANE=true but NO execution lane is named on this deployment — refusing to start. ` +
+        `With no lane the engine falls back to its in-process stub environment: the hands band (the roster entries whose ` +
+        `wiring_manifest mountedBy is "hands", Bash among them) is not mounted, while the rest of the roster still executes, ` +
+        `and every task still returns status=completed — for any request that needs a hand, indistinguishable from "the model ` +
+        `chose not to use its tools". (How much of the roster is mounted is a per-run fact: read the wiring_manifest event and ` +
+        `count entries whose mountedBy is "hands" — never judge by tool names.) ` +
+        `Cause: REMOTE_EXEC is unset/empty AND CONFIG_PROVIDER is not "local". ` +
+        `Fix: set REMOTE_EXEC to one of ${REMOTE_EXEC_PROVIDER_WORDS.join(" | ")} (and that lane's required env), ` +
+        `or set CONFIG_PROVIDER=local to take the single-machine \`host\` default, ` +
+        `or unset REQUIRE_EXECUTION_LANE to keep running without hands on purpose.`);
 }
-export const ALL_EXECUTION_LANES = Object.freeze(Object.keys(EXECUTION_LANE_WORDS).filter(isExecutionLane));
-export const REMOTE_EXEC_PROVIDER_WORDS = Object.freeze(ALL_EXECUTION_LANES.filter((lane) => lane !== "in-process"));
 export function executionLaneOf(provider) {
     if (provider === undefined)
         return "in-process";

package/dist/hooks/hook-runner.d.ts

@@ -36,17 +36,97 @@ export interface ParseHooksConfigResult {
     error?: string;
 }
 /**
- * fresh 提交面专用判据(S-924):配置里第一条「永远打不中」的工具事件 matcher 的拒句;没有 ⇒ undefined。
- * 入参是 {@link parseHooksConfig} 已校验过的配置。**只有 `admission.ts` 的 fresh 提交门调它** —— resume 重放不调(理由见上面的头注)。
+ * 🔴 **S-924 → S-995(clay [ref] ③;八病审计 SG H6-d;test 7.112.0 验收 OBS ①)—— 工具事件的 matcher 选中了工具**别名**、却选不中它的正名 ⇒ fresh 提交面响亮拒。**
+ *
+ * 病:三个工具事件(PreToolUse / PostToolUse / PostToolUseFailure)的 matcher 都按调用的 **wire 名**匹配(本文件顶注
+ * 「tool_name 是哪一个名」;core `NAME_READINGS` 三行均为 `wire`)。引擎自带工具 `ListAgents` 的别名 `ListPeers` 写进 matcher
+ * ⇒ **永不命中、一句话都没有**(post 两事件自 7.107.0 / core 7.36.0 起如此,PreToolUse 一直如此)。静默不命中 = 写的人以为在生效的 hook
+ * 其实没跑,硬破坏三句要求的「响亮」没有着落。7.112.0(S-924)只拒**字面**别名;同一个错误写成 `^ListPeers$` / `ListPeers.*` / `(ListPeers)` 照样 200(S-995)。
+ *
+ * 规则(一条;字面形是它的特例):{@link deadToolMatcherIssue} 对 core 静态目录里**每一条退役别名**问「这只 matcher 选不选它 / 选不选它的正名」:
+ * matcher **命中别名 ∧ 不命中它的正名** ⇒ `400 request.field_invalid`(`admission.ts` fresh 门)。「选不选」与运行期 {@link hookMatcherMatches} 同一套读法,按**一条顺序**判(两档共用,7.114.0 修复轮):
+ *  ① **长度上限**:超 {@link MAX_MATCHER_EVAL_CHARS} 的 matcher 两档都不读 ⇒ 未判(reason = oversize);
+ *  ② 空 / `*` 命中一切 ⇒ 永不「死」;
+ *  ③ **字面 / 名字表读法**({@link matcherLiteralNames},与运行期共用:`|` 与 `,` 分隔、每段 trim〔容忍两端与分隔符两侧空白〕、不折大小写、不剥词内空白)
+ *    两档都先走、每只 matcher 读一次、**不占求值预算**,按名字表成员答 —— 所以两档在字面子集上答案逐位相同是构造出来的(R5f 语料再钉);
+ *  ④ 只剩**正则形**:**`"regex"` 档**(hooks 会被采纳的车道,`taskHooksHonored`)问运行期正则臂的那一只函数 {@link matcherPatternMatches}(同一个函数对象,锚定正则),
+ *    经 `node:vm` 的 `timeout` 带一次受理共享的预算调用({@link matcherPatternMatchesWithin});**`"literal"` 档**(多租户车道:hooks 整只被 resolveSpec 忽略)
+ *    = **不适用**:该车道没有被守的对象(hooks 不装配),不判、不算未判、不登记 —— **零正则求值、零调用方正则执行**(7.112.0 的字面判保留:裸 `ListPeers` / `Read|ListPeers` 照旧 400)。
+ *  · **为什么两档**(codex r1 [high] + 主会话裁):受理面是**所有**车道,而运行期只有单用户车道跑 hooks。在受理线程上跑调用方的正则 = 给多租户加一个事件循环 DoS 面
+ *    (实测:`(.*)*` ×10 + `X` 对 9 字符名字首次执行 1.7 s,18 字符嵌套形 15 s,24 字符 157 s;8 MiB 交替串编译 + 求值 9 s)—— 预算只界住一次请求、界不住「每个请求再拿一份」。
+ *    但也不能因此在多租户车道「不判决」(那会放宽已发行为:裸 `ListPeers` 的 400)。所以两车道同一条规则、两档深度。谓词 `taskHooksHonored` 是唯一属主(与 resolveSpec / capabilities 同调)。
+ *  · **为什么不进 {@link parseHooksConfig}**(codex r1 [high],S-924):`parseHooksConfig` 同时是 resume 重放(`parseTaskSettings` 宽容层)的校验器,
+ *    它判不过 ⇒ **整只 hooks 不采纳**。存量 body 里同一份 hooks 常常还有会真拦的 PreToolUse 钩子 —— 一个永不命中的别名 matcher 把它们一并带走,
+ *    升级前被拦的 Bash 升级后放行(安全轴上的回退)。所以这条规则住在 fresh 专用的判据里,与 `taskSettingsKeyIssue` 同姿势
+ *    (「fresh 400 / resume 宽容」双层:会砖存量的规则只咬 fresh)。resume 照旧整只采纳,别名那一组继续永不命中(与 7.111.0 逐字同),其余照跑。
+ *  · **哪些事件** = 契约 `HOOK_EVENT_MATCHER_FIELD[event] === "tool_name"` ∧ 引擎属主 `HOOK_EVENT_OWNER[event] === "engine"`
+ *    (今天恰是上面三个;`PermissionRequest` / `PermissionDenied` 也匹配 `tool_name` 但属壳,壳自己跑,不是本 runner 的读法)。**不手抄事件表**([ref])。
+ *  · **哪些名字算别名** = core 静态目录(`describeToolCatalog()`)里某条 `face.aliases` 的成员,且它自己不是另一条目的 wire 名({@link engineToolAliases})。
+ *    **只读这一只真源**([ref])。本仓自身不声明带别名的工具;嵌入方经 `resolveSpec` 席挂的别名与 MCP 工具名在受理面看不见(名册是每任务装配的),**不在射程**。
+ *  · **正名同在则不拒**:`正名|别名` / `List.*` 会命中正名,不是「静默不命中」,且正是 7.107.0 CHANGELOG 给的「滚动期两名都写」补偿形。
+ *    只拒「别名那一路永远打不中、而它的正名不在选中集里」—— 含 `Read|ListPeers`(7.112.0 已拒;主会话裁:规则形采「按条目逐条问」,不放宽;卡面整 matcher「匹配不到任何现役名」形会把它放回 200)。
+ *    多拒(相对卡面形)三例与出路:`Read|ListPeers` / `ListPeers|mcp__.*`(别名支永不命中,出路:改成正名)/ 排除式 `^(?!ListAgents).*`(出路:`^(?!ListAgents|ListPeers).*` 两名都不命中 ⇒ 放)。
+ *  · **空白与大小写(S-995 / sema-test [ref] 起,运行期与 CC 2.1.280 同形)**:字面 / 名字表读法({@link matcherLiteralNames};`|` 与 `,` 分隔)容忍两端与分隔符两侧空白 ⇒ `" ListPeers"` / `"ListPeers "` / `"Read | ListPeers"` 会命中别名 ⇒ 落进本规则 400;
+ *    **区分大小写、不剥词内空白** ⇒ `"listpeers"` / `"List Peers"` 对别名与正名都选不中,照旧受理(CC 同形)。
+ *  · **不在本规则内**:两边都选不中的 matcher(大小写错 / 词内空白 / 纯错字;目录之外的 MCP / 嵌入方工具名同样「选不中目录里任何名」,受理面无从区分错字与它们)=
+ *    **「选不到目录里任何名」另一类,候设计(台账另立号,主会话裁)**。
+ *
+ * 🔴 **「未判」臂过 `recordFailOpen`**(F 类 tag `MATCHER_UNJUDGED_TAG`;主会话裁,CLAUDE.md「合法 F 类回退走登记 tag」):一只 matcher 没能被判 ⇒ 照旧受理 + 登记一笔,
+ * detail = `event=… reason=… matcherChars=…`(**不带 matcher 原字节**,S-716 姿势)。三种 reason 同一个 tag:
+ *   `oversize` —— 两档:matcher 超 {@link MAX_MATCHER_EVAL_CHARS} 字符不读(多租户车道上 hooks 不装配,这一笔只为让超长输入显形);
+ *   `over_budget` ——「regex」档正则形:一次受理共享一份 {@link ADMISSION_MATCHER_EVAL_BUDGET_MS} 墙钟预算,用尽 ⇒ 这一只与其后各只正则形未判(`vm` 的 `timeout` 打断回溯,含 tier-up 之后的原生码);
+ *   `invalid_regex` ——「regex」档正则形编不过(运行期另有每次调用的 `hook_matcher_invalid`;这是确定性的坏配置,不是负载 —— 拒它是新检测臂,不在本规则)。
+ * 放行最坏后果 = 那一只 matcher 没被这条判据守住、照旧永不命中,**不是安全闸**(受理面有效性判);反方向「越界即拒」会把负载抖动 / 病态但合法的 matcher 变成对合法请求的 400。
+ * 拒放集合相对 7.113.0 的一处放宽(披露在 CHANGELOG / MIGRATION):超过上限的字面别名 matcher 7.113.0 拒(当时字面判不设上限),自 7.114.0 两档都判未判、受理。
+ *
+ * 错误句只回显**目录里的**别名与正名(闭集字符串),不回显调用方的原字节(S-716 姿势)。
+ */
+/** 超此长度的 matcher 不在受理面读(两档同一个上限;未判,reason = oversize)。与 {@link MAX_HOOK_COMMAND_CHARS} 同量纲的服务侧防线:真实 matcher(精确名 / 交替 / `mcp__.*`)远在其内;目录全部工具名交替 ~0.5 KiB。 */
+export declare const MAX_MATCHER_EVAL_CHARS = 8192;
+/** 一次 fresh 受理里 regex 档**正则形**求值共享的墙钟预算(毫秒)。字面形不占它。良性求值 ~0.1 ms;灾难回溯的 matcher 把预算吃完就停,后面的正则形组直接「未判」。 */
+export declare const ADMISSION_MATCHER_EVAL_BUDGET_MS = 100;
+/** 受理面判据的求值深度(见上头注):`"regex"` = 字面形按名字表答、正则形问运行期同一只正则求值(带预算);`"literal"` = 7.112.0 的字面判(零正则,正则形不适用)。 */
+export type MatcherEvalDepth = "regex" | "literal";
+/**
+ * **仅供测试注入**的求值预算(生产调用点不传 ⇒ 预算 = {@link ADMISSION_MATCHER_EVAL_BUDGET_MS}、时钟 = `performance.now`)。
+ * 让「预算是一次受理共享的」「耗尽之后的组」这类格子按求值次序断言,不按机器速度断言(`test/hooks-alias-matcher-s995.test.ts` R4)。
  */
-export declare function deadToolMatcherIssue(config: HooksConfig): string | undefined;
+export interface MatcherEvalBudget {
+    readonly budgetMs?: number;
+    readonly now?: () => number;
+}
+/**
+ * fresh 提交面专用判据(S-924 / S-995):配置里第一条「永远打不中」的工具事件 matcher 的拒句;没有 ⇒ undefined。
+ * 入参是 {@link parseHooksConfig} 已校验过的配置;`depth` 由调用点按车道定(见头注:`taskHooksHonored(config) ? "regex" : "literal"`)。
+ * `budget` **仅供测试注入**({@link MatcherEvalBudget});生产调用点只传前两个实参。
+ * **只有 `admission.ts` 的 fresh 提交门调它** —— resume 重放不调(理由见上面的头注)。未判的 matcher 过 `recordFailOpen`(tag `MATCHER_UNJUDGED_TAG`)。
+ */
+export declare function deadToolMatcherIssue(config: HooksConfig, depth: MatcherEvalDepth, budget?: MatcherEvalBudget): string | undefined;
 /**
  * 把 wire 上的 untrusted `settings.hooks` 校验成契约 {@link HooksConfig} + 服务侧上限。
  * 错误返回 error 字符串而不 throw——submit 路径 400 fail-loud、resume 防御路径 warn-drop,由调用方选。
  */
 export declare function parseHooksConfig(raw: unknown): ParseHooksConfigResult;
-/** CC matcher 语义:精确名、`a|b` 交替、或 JS 正则(锚定全匹配,防 "Bash" 误配 "BashOutput");
- *  空/`*`/缺省匹配一切;非法正则 → 该条不匹配(fail-closed 到"不跑",由调用方记账一次)。 */
+/**
+ * matcher 的**字面 / 名字表读法**(S-995 / sema-test [ref];与 CC 2.1.280 同形):matcher 只含名字字符(`[A-Za-z0-9_-]`)、竖线、**逗号**与**空格**时,它不是正则而是「名字列表」——
+ * 按 `[|,]` 拆、**每段 trim**、丢空段;返回这张名字表。含任何别的字符(`.` / `*` / 括号 / 制表 / 换行 …)⇒ `undefined` = 不是字面读法,整体当正则(由调用方处置,**一字不动**)。
+ * 大小写敏感、词内空白不剥(`"Ba sh"` 是一个词 `Ba sh`)。**对所有带 matcher 的事件同一只读法**(工具事件 / StopFailure 的 `error` 词 / PreCompact·PostCompact 的 `trigger` 词 /
+ * `if` 条件的名部),不按事件分档。
+ *
+ * 等价性的依据(收车档 ⑥ / ⑦):
+ *  · 黑盒 —— sema-test `repro/cc-r219-mcpstar-hookmatcher-20261003/`([ref],CC 2.1.280 真 TUI + 真 command 钩子):`" Bash"` / `"Bash "` / `" Bash "` / `"Read | Bash"` 命中 3/3,
+ *    `"Ba sh"`(词内空白)/ `bash` / `BASH` 不命中(零告警),`^Bash$` / `Bash.*` / `(Bash)` / `Read|Bash` 照命中;PreToolUse 与 PostToolUse 同向。**逗号没有黑盒读数**,只有语料。
+ *  · 语料 —— `sema-internal/blueprints/cc-decoded/cli280.js:216638` `uAe(matchValue, matcher, flag, …)` → `$mr(matcher, flag, …)`:`flag` 真时字符集门 `/^[a-zA-Z0-9_|, -]+$/` 过了才
+ *    `matcher.split(/[|,]/).map(trim).filter(Boolean)` 做成员判;过不了才 `new RegExp(matcher)`(CC 的正则路径**不锚定**,本仓锚定 `^(?:…)$` —— 既有差异,不动)。
+ *    本函数的字符集与拆符与 CC 逐字同(空白只认空格 0x20)。
+ *  · 已知差异(如实登记,本车不做):CC 的空白 / 逗号放行**按事件分档**(`dAe` 集合:工具事件 / PreCompact / PostCompact 等放,StopFailure 不放),本函数不分事件(第二批裁:同一只读法);
+ *    CC 正则路径不锚定、本仓锚定。两条登记在 CHANGELOG 7.114.0 线 · 车 UW 已知边界。
+ * 零正则:单趟逐字符扫描(7.114.0 修复轮起;只为非空段分配名字,不按分隔符个数分配)。受理面两档({@link deadToolMatcherIssue})与运行期求值**共用这一只**读法,且两档都先走它、不占求值预算 ——
+ * 两档在字面子集上答案逐位相同是**构造出来的**,不是对拍出来的(超过长度上限的 matcher 两档都不读、同判未判)。
+ */
+export declare function matcherLiteralNames(matcher: string): readonly string[] | undefined;
+/** CC matcher 语义:空/`*`/缺省匹配一切;**字面 / 名字表读法**({@link matcherLiteralNames}:`|` 与 `,` 分隔、每段 trim、不剥词内空白、区分大小写)按名字表成员判;
+ *  其余整体当 JS 正则({@link matcherPatternMatches};锚定全匹配;S-995 起正则路径一字不动);非法正则 → 该条不匹配(fail-closed 到"不跑",由调用方记账一次)。 */
 export declare function hookMatcherMatches(matcher: string | undefined, value: string): boolean | "invalid";
 /** `if` 条目条件(CC-exact,对照 CC 2.1.187/198 实测行为核验的真语义,两版一致):
  *  值 = permission-rule 模式(`ToolName` 或 `ToolName(arg-模式)`),【不是】表达式语言——按当前工具调用
@@ -179,8 +259,8 @@ export declare function createTaskHooks(config: HooksConfig, ctx: HookRunnerCont
  * 把部署级 hooks 基线(deps.hooks,如 TOOL_TRACE 观测)折进 task 级 hooks——core 是整槽覆盖
  * (`spec.hooks ?? deps.hooks`),不折叠就静默 shadow 部署观测(runtask gateBaseline 注释点名的坑)。
  * 语义:部署槽先跑(观测看到原始输入/输出),task 槽后跑;结果合并:
- *  - preToolUse:deny > ask > allow 折叠;updatedInput 串行线程(部署重写喂给 task 槽);context 拼接。读不出词的结果
- *    (非对象、集外 `action`)原样交回、由引擎的接手屏判(S-959,短路同 deny)。
+ *  - preToolUse:每一槽的结果**先过 core 的 hook 席收据** `receiveHookResult`(S-971,core 7.39.0 #1274)—— 引擎拒的载体 ⇒ 交回引擎的拒绝体
+ *    (短路,引擎按自己的 fail-closed 拒处置);收下的 ⇒ 折它的冻结副本:deny > ask > allow 折叠;updatedInput 串行线程(部署重写喂给 task 槽);context 拼接。
  *  - postToolUse/postToolUseFailure/postToolBatch:双跑,additionalContext 拼接,updatedOutput 取
  *    后者(task 槽)优先。
  *  - userPromptSubmit/stop:部署 block 优先短路(不再跑 task 槽),否则双跑、context 拼接、task block 生效。

package/dist/hooks/hook-runner.js

@@ -1,7 +1,8 @@
 import { spawn } from "node:child_process";
+import vm from "node:vm";
 import { hostShell, resolveHostShell, adoptHostForegroundChild } from "../plugins/host-platform.js";
 import { HooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_EVENT_OWNER, HOOK_EVENT_MATCHER_FIELD, } from "@sema-agent/settings-schema/hooks";
-import { describeToolCatalog } from "@sema-agent/core";
+import { describeToolCatalog, isEngineRefusal, receiveHookResult } from "@sema-agent/core";
 import { boundedNoticeText } from "../fleet/fleet-bus.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets, buildDisplaySafeUrl } from "../trace/redact.js";
@@ -57,7 +58,9 @@ function toAssistantTurnError(errorKind) {
         return "unknown";
     return Object.prototype.hasOwnProperty.call(BRAIN_TO_TURN_ERROR, errorKind) ? (BRAIN_TO_TURN_ERROR[errorKind] ?? "unknown") : "unknown";
 }
-const NAME_ALTERNATION = /^[A-Za-z0-9_-]+(?:\|[A-Za-z0-9_-]+)*$/;
+export const MAX_MATCHER_EVAL_CHARS = MAX_HOOK_COMMAND_CHARS;
+export const ADMISSION_MATCHER_EVAL_BUDGET_MS = 100;
+const MATCHER_UNJUDGED_TAG = "server.hooks.matcher-unjudged";
 function matcherReadsWireToolName(event) {
     return HOOK_EVENT_OWNER[event] === "engine" && HOOK_EVENT_MATCHER_FIELD[event] === "tool_name";
 }
@@ -77,25 +80,85 @@ function engineToolAliases() {
     engineToolAliasTable = table;
     return table;
 }
-function deadAliasInMatcher(event, matcher) {
-    if (matcher === undefined || !matcherReadsWireToolName(event) || !NAME_ALTERNATION.test(matcher))
+let matcherEvalBox;
+function matcherPatternMatchesWithin(matcher, name, budget) {
+    const remaining = budget.deadlineMs - budget.now();
+    if (remaining <= 0)
+        return "over_budget";
+    matcherEvalBox ??= {
+        script: new vm.Script("matcherPatternMatches(matcher, name)"),
+        context: vm.createContext({ matcherPatternMatches, matcher: "", name: "" }),
+    };
+    matcherEvalBox.context.matcher = matcher;
+    matcherEvalBox.context.name = name;
+    try {
+        const verdict = matcherEvalBox.script.runInContext(matcherEvalBox.context, { timeout: Math.max(1, Math.ceil(remaining)) });
+        return verdict === true ? true : verdict === false ? false : "invalid";
+    }
+    catch (err) {
+        if (typeof err === "object" && err !== null && "code" in err && err.code === "ERR_SCRIPT_EXECUTION_TIMEOUT")
+            return "over_budget";
+        throw err;
+    }
+}
+function deadAliasInMatcher(matcher, depth, budget) {
+    if (matcher.length > MAX_MATCHER_EVAL_CHARS)
+        return { kind: "unjudged", reason: "oversize" };
+    if (matcher === "" || matcher === "*")
+        return undefined;
+    const names = matcherLiteralNames(matcher);
+    if (names !== undefined) {
+        for (const [alias, canonical] of engineToolAliases()) {
+            if (names.includes(alias) && !names.includes(canonical))
+                return { kind: "dead", alias, canonical };
+        }
         return undefined;
-    const branches = matcher.split("|");
-    const aliases = engineToolAliases();
-    for (const branch of branches) {
-        const canonical = aliases.get(branch);
-        if (canonical !== undefined && !branches.includes(canonical))
-            return { alias: branch, canonical };
+    }
+    switch (depth) {
+        case "literal":
+            return undefined;
+        case "regex":
+            break;
+        default: {
+            const unreachable = depth;
+            return unreachable;
+        }
+    }
+    const selects = (name) => {
+        const verdict = matcherPatternMatchesWithin(matcher, name, budget);
+        return verdict === "invalid" ? "invalid_regex" : verdict;
+    };
+    for (const [alias, canonical] of engineToolAliases()) {
+        const selectsAlias = selects(alias);
+        if (typeof selectsAlias === "string")
+            return { kind: "unjudged", reason: selectsAlias };
+        if (!selectsAlias)
+            continue;
+        const selectsCanonical = selects(canonical);
+        if (typeof selectsCanonical === "string")
+            return { kind: "unjudged", reason: selectsCanonical };
+        if (!selectsCanonical)
+            return { kind: "dead", alias, canonical };
     }
     return undefined;
 }
-export function deadToolMatcherIssue(config) {
+export function deadToolMatcherIssue(config, depth, budget = {}) {
+    const now = budget.now ?? (() => performance.now());
+    const deadline = { deadlineMs: now() + (budget.budgetMs ?? ADMISSION_MATCHER_EVAL_BUDGET_MS), now };
     for (const [event, groups] of Object.entries(config)) {
+        if (!matcherReadsWireToolName(event))
+            continue;
         for (const group of groups ?? []) {
-            const dead = deadAliasInMatcher(event, group.matcher);
-            if (dead) {
-                return `settings.hooks.${event}: matcher "${dead.alias}" is an alias; tool-event matchers match the tool's wire name (PostToolUse / PostToolUseFailure since 7.107.0) — use "${dead.canonical}"`;
+            if (group.matcher === undefined)
+                continue;
+            const verdict = deadAliasInMatcher(group.matcher, depth, deadline);
+            if (verdict === undefined)
+                continue;
+            if (verdict.kind === "unjudged") {
+                recordFailOpen(MATCHER_UNJUDGED_TAG, `event=${event} reason=${verdict.reason} matcherChars=${group.matcher.length}`);
+                continue;
             }
+            return `settings.hooks.${event}: matcher "${verdict.alias}" is an alias; tool-event matchers match the tool's wire name (PostToolUse / PostToolUseFailure since 7.107.0) — use "${verdict.canonical}"`;
         }
     }
     return undefined;
@@ -144,9 +207,31 @@ export function parseHooksConfig(raw) {
     }
     return { config };
 }
-export function hookMatcherMatches(matcher, value) {
-    if (matcher === undefined || matcher === "" || matcher === "*")
-        return true;
+export function matcherLiteralNames(matcher) {
+    const names = [];
+    let first = -1;
+    let last = -1;
+    for (let i = 0; i <= matcher.length; i++) {
+        const c = i < matcher.length ? matcher.charCodeAt(i) : 0x7c;
+        if (c === 0x7c || c === 0x2c) {
+            if (first !== -1)
+                names.push(matcher.slice(first, last + 1));
+            first = -1;
+            last = -1;
+            continue;
+        }
+        if (c === 0x20)
+            continue;
+        const nameChar = (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a) || c === 0x5f || c === 0x2d;
+        if (!nameChar)
+            return undefined;
+        if (first === -1)
+            first = i;
+        last = i;
+    }
+    return names;
+}
+function matcherPatternMatches(matcher, value) {
     if (matcher === value)
         return true;
     try {
@@ -156,6 +241,14 @@ export function hookMatcherMatches(matcher, value) {
         return "invalid";
     }
 }
+export function hookMatcherMatches(matcher, value) {
+    if (matcher === undefined || matcher === "" || matcher === "*")
+        return true;
+    const names = matcherLiteralNames(matcher);
+    if (names !== undefined)
+        return names.includes(value);
+    return matcherPatternMatches(matcher, value);
+}
 export function hookIfMatches(cond, payload) {
     if (cond.length > 500 || (cond.match(/\*/g)?.length ?? 0) > 16)
         return "unevaluable";
@@ -1234,10 +1327,10 @@ export function composeHooks(deployment, task) {
             for (const slot of [d.preToolUse?.bind(d), t.preToolUse?.bind(t)]) {
                 if (!slot)
                     continue;
-                const r = await slot(toolName, current, ctx);
-                if (r === undefined || Object.is(r, null) || Object.is(r, false))
+                const r = receiveHookResult(await slot(toolName, current, ctx));
+                if (r === undefined || r === null || r === false)
                     continue;
-                if (typeof r !== "object")
+                if (isEngineRefusal(r))
                     return r;
                 if (r.additionalContext)
                     contexts.push(r.additionalContext);

package/dist/host-decision.d.ts

@@ -22,7 +22,9 @@ import { type AskOutcome, type ResumeOutcome } from "@sema-agent/core";
  *    而 sweep 结构上不能 `allow`)。
  *  · `decidedBy: "policy"`(core 7.26.2 / #1016)—— **这台部署自己的策略**拒的:答话的是机器不是人。调用方
  *    经决裁体的 `settledBy` 自报;core 据它给模型铸一句**策略句**(而不是「用户不同意,停下来等他」),
- *    并把结算记成 `policy_refused`(`who.party:"none"`)。`allow` 侧结构上不可(core pre-CAS 拒:只有人批准)。
+ *    并把结算记成 `policy_refused`(`who.party:"policy"`,core 7.39.0 #1265 起;此前 `"none"`)。`allow` 侧:core 7.39.0 起引擎收策略的
+ *    放行(`policy_allowed`),但本仓的两条 decide 口**不开**这一形(`tool-approval.ts` 的 `SETTLED_BY_ONLY_ON_DENY` 与店列的同一条拒仍在 ——
+ *    耐久车道上的机器放行是一件没裁过的新能力,不在 7.113.0 提货批内,候登)。
  *  · `approver` —— 通道自报的结算方标识串。**缺席永不读成**「没人批」或「有人批」,只意味着通道没报名字。
  */
 /**
@@ -74,8 +76,8 @@ export type HostDecidedBy = HostDecision["decidedBy"];
  * 被改造过的串):归属是转录,不是可以「修一修」的东西 —— 修出来的名字既不是通道报的那个,也不是
  * 「通道没报」,两头都不真。
  *
- * 🔴 归属**不按词分岔**:core 的 `policy_refused` 结算记录上确实没有归属席(`who.party:"none"`),但那是
- * **core 的记录**怎么写,不是**本服务观察到的事实**是什么 —— 送出这次请求的那把已验证身份是真的,本仓的
+ * 🔴 归属**不按词分岔**:core 7.38.x 的 `policy_refused` 结算记录上没有归属席(`who.party:"none"`),7.39.0 #1265 起有了
+ * (`who.party:"policy"`,`approver?`)—— 无论 core 的记录怎么写,**本服务观察到的事实**不变:送出这次请求的那把已验证身份是真的,本仓的
  * 迟到结算账本(`approval-ask-audit-store.ts`)记的就是它。按词删一格 = 给账本挖一个只在某个词上出现的洞。
  *
  * 🔴 **入参是 `string`,不是 `HostDecidedBy` —— 这一格刻意让类型说真话**(wire 边界强类型宪法):两条

package/dist/hosted-posture.d.ts

@@ -13,8 +13,8 @@
  *    比手抄的值更难发现烂掉,[ref] 的第一排查点就是它;
  *  · 能力授予面的赦免挂在 **`requirePrincipal !== true`** 上 —— 但**三条面各有各的谓词,不是一只**
  *    (异源复核实测,别照「它们都一样」写):
- *     · `settings.hooks` —— `boot/resolve-spec.ts` 的 hooks 臂,判据**只有** `config.requirePrincipal === true`
- *       ⇒ 忽略(**不看车道**,任何 `REMOTE_EXEC` 都一样);
+ *     · `settings.hooks` —— `task-settings.ts` 的 `taskHooksHonored`(唯一属主;resolve-spec 装配 / 受理面 / 能力位三处同调),判据**只有**
+ *       `requirePrincipal !== true` ⇒ 采纳,否则忽略(**不看车道**,任何 `REMOTE_EXEC` 都一样);
  *     · `additionalDirectories` / `additionalReadDirectories` —— **只有** `cwdHonored`
  *       (= `provider === "host" ∧ requirePrincipal !== true`);
  *     · `settings.env` / `cwd` —— `cwdHonored ‖ deviceCwdHonored`,而

package/dist/http/admission.js

@@ -2,7 +2,7 @@ import { isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
@@ -200,7 +200,7 @@ export function createAdmission(ctx) {
                     sendError(res, 400, "request.field_invalid", hooksParsed.error ?? "settings.hooks: invalid shape");
                     return null;
                 }
-                const deadMatcher = deadToolMatcherIssue(hooksParsed.config);
+                const deadMatcher = deadToolMatcherIssue(hooksParsed.config, taskHooksHonored(deps.config) ? "regex" : "literal");
                 if (deadMatcher !== undefined) {
                     sendError(res, 400, "request.field_invalid", deadMatcher);
                     return null;
@@ -550,11 +550,15 @@ export function createAdmission(ctx) {
         if (body.attachments !== undefined) {
             const a = body.attachments;
             if (typeof a !== "object" || a === null || Array.isArray(a)) {
-                sendError(res, 400, "request.field_invalid", "attachments must be an object { todoReminder?, todoReminderMode?, changedFiles?, planModeReminder?, budgetUsd?, backgroundTasks?, toolsDelta?, agentListing?, skillsListing?, mcpInstructions? }");
+                sendError(res, 400, "request.field_invalid", "attachments must be an object { todoReminder?, todoReminderMode?, changedFiles?, budgetUsd?, backgroundTasks?, toolsDelta?, agentListing?, skillsListing?, mcpInstructions? }");
                 return null;
             }
             const rec = a;
-            for (const k of ["todoReminder", "planModeReminder", "budgetUsd", "backgroundTasks", "toolsDelta", "agentListing", "skillsListing", "mcpInstructions"]) {
+            if (rec.planModeReminder !== undefined) {
+                sendError(res, 400, "request.field_invalid", 'attachments.planModeReminder was retired in core 7.39.0 — the engine now states plan posture itself whenever the permission mode is "plan" (first request, periodic reminders, exit frame); remove the key (send permissionMode "plan" for plan posture)');
+                return null;
+            }
+            for (const k of ["todoReminder", "budgetUsd", "backgroundTasks", "toolsDelta", "agentListing", "skillsListing", "mcpInstructions"]) {
                 if (rec[k] !== undefined && typeof rec[k] !== "boolean") {
                     sendError(res, 400, "request.field_invalid", `attachments.${k} must be a boolean`);
                     return null;

package/dist/http/request-guards.js

@@ -1,6 +1,6 @@
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs } from "@sema-agent/core";
 import { HttpError, principalFrom } from "../security.js";
-import { RUN_NOT_FOUND_MESSAGE } from "./route-ctx.js";
+import { RUN_NOT_FOUND_MESSAGE, SESSION_NOT_FOUND_MESSAGE } from "./route-ctx.js";
 import { sendError } from "./send.js";
 import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal } from "./principal-gate.js";
 const MAX_BODY = 8 * 1024 * 1024;
@@ -165,7 +165,7 @@ export function createRequestGuards(ctx) {
         }
         if (!runOwnerReadable(principal, owner, deps.config)) {
             if (notFoundForm === "session")
-                sendError(res, 404, "not_found.session", "session not found");
+                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
             else
                 sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
             return false;

package/dist/http/resume-legs.d.ts

@@ -12,16 +12,21 @@
  * (`RunRegistry` / `RouteHelpers` / `RouteLegs` / `ReturnType<typeof createRequestGuards>`),不手抄签名 ⇒ 不会漂。
  */
 import type { IncomingMessage } from "node:http";
-import { type QuestionAnswer, type CheckpointToken } from "@sema-agent/core";
+import { CheckpointError, type QuestionAnswer, type CheckpointToken } from "@sema-agent/core";
 import type { DecideBinding } from "./wire-types.js";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type HostDecision } from "../host-decision.js";
 import { type PlanApprovePermissionModeAfter } from "../task-settings.js";
-import type { RouteCtxBase, DriveResumeArgs, PreparedPlanReview, ResumeLegOutcome } from "./route-ctx.js";
+import type { RouteCtxBase, DriveResumeArgs, HostLegOutcome, PreparedPlanReview, ResumeLegOutcome } from "./route-ctx.js";
 import { type TrustedRunInternals } from "./durable-run-leg.js";
 import type { RunRegistry, RouteHelpers, RouteLegs } from "./route-ctx.js";
 import type { createRequestGuards } from "./request-guards.js";
 import type { FlatServiceDeps } from "./server.js";
+/**
+ * {@link CHECKPOINT_ERROR_DISPOSITION} 的读口(纯函数,resume 腿的 catch 臂与钉共用)。运行期遇到表外的码(装树 core 比本二进制多一个码的版本偏斜 ——
+ * 型面上拼不出来)⇒ `"terminal"`:与 `by_reason` 认不得的词同一条 fail-closed 方向(不宽容默认成可重试),也与修前手列串的缺省逐字相同。
+ */
+export declare function checkpointErrorDisposition(e: CheckpointError): "cancelled" | "retriable" | "terminal";
 export declare function createResumeLegs(ctx: {
     deps: FlatServiceDeps;
     runnerFor: FlatServiceDeps["runnerFor"];
@@ -50,14 +55,8 @@ export declare function createResumeLegs(ctx: {
         status: number;
         body: object;
     }>;
-    startFreshHostTurn: (sessionId: string, objective: string, principal: string | undefined, req: IncomingMessage, trustedInternals: TrustedRunInternals, runId: string) => Promise<{
-        status: number;
-        body: object;
-    }>;
-    resumeWake: (sessionId: string, message: string | undefined, caller: string | undefined, req: IncomingMessage | undefined, acceptEarly?: boolean, workflowParkedResume?: DriveResumeArgs["workflowParkedResume"], ownerLeaseAdmittedFor?: string) => Promise<{
-        status: number;
-        body: object;
-    }>;
+    startFreshHostTurn: (sessionId: string, objective: string, principal: string | undefined, req: IncomingMessage, trustedInternals: TrustedRunInternals, runId: string) => Promise<HostLegOutcome>;
+    resumeWake: (sessionId: string, message: string | undefined, caller: string | undefined, req: IncomingMessage | undefined, acceptEarly?: boolean, workflowParkedResume?: DriveResumeArgs["workflowParkedResume"], ownerLeaseAdmittedFor?: string) => Promise<HostLegOutcome>;
     preparePlanReview: (sessionId: string, log?: {
         taskId?: string;
         principalPresent?: boolean;