@sema-agent/server 7.113.0 → 7.115.0

package/dist/hooks/hook-runner.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import vm from "node:vm";
 import { hostShell, resolveHostShell, adoptHostForegroundChild } from "../plugins/host-platform.js";
 import { HooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_EVENT_OWNER, HOOK_EVENT_MATCHER_FIELD, } from "@sema-agent/settings-schema/hooks";
 import { describeToolCatalog, isEngineRefusal, receiveHookResult } from "@sema-agent/core";
@@ -57,7 +58,9 @@ function toAssistantTurnError(errorKind) {
         return "unknown";
     return Object.prototype.hasOwnProperty.call(BRAIN_TO_TURN_ERROR, errorKind) ? (BRAIN_TO_TURN_ERROR[errorKind] ?? "unknown") : "unknown";
 }
-const NAME_ALTERNATION = /^[A-Za-z0-9_-]+(?:\|[A-Za-z0-9_-]+)*$/;
+export const MAX_MATCHER_EVAL_CHARS = MAX_HOOK_COMMAND_CHARS;
+export const ADMISSION_MATCHER_EVAL_BUDGET_MS = 100;
+const MATCHER_UNJUDGED_TAG = "server.hooks.matcher-unjudged";
 function matcherReadsWireToolName(event) {
     return HOOK_EVENT_OWNER[event] === "engine" && HOOK_EVENT_MATCHER_FIELD[event] === "tool_name";
 }
@@ -77,25 +80,92 @@ function engineToolAliases() {
     engineToolAliasTable = table;
     return table;
 }
-function deadAliasInMatcher(event, matcher) {
-    if (matcher === undefined || !matcherReadsWireToolName(event) || !NAME_ALTERNATION.test(matcher))
+let matcherEvalBox;
+function matcherPatternMatchesWithin(matcher, name, budget) {
+    const remaining = budget.deadlineMs - budget.now();
+    if (remaining <= 0)
+        return "over_budget";
+    matcherEvalBox ??= {
+        script: new vm.Script("matcherPatternMatches(matcher, name)"),
+        context: vm.createContext({ matcherPatternMatches, matcher: "", name: "" }),
+    };
+    matcherEvalBox.context.matcher = matcher;
+    matcherEvalBox.context.name = name;
+    try {
+        const verdict = matcherEvalBox.script.runInContext(matcherEvalBox.context, { timeout: Math.max(1, Math.ceil(remaining)) });
+        return verdict === true ? true : verdict === false ? false : "invalid";
+    }
+    catch (err) {
+        if (typeof err === "object" && err !== null && "code" in err && err.code === "ERR_SCRIPT_EXECUTION_TIMEOUT")
+            return "over_budget";
+        throw err;
+    }
+}
+function deadAliasInMatcher(matcher, depth, budget) {
+    if (matcher.length > MAX_MATCHER_EVAL_CHARS)
+        return { kind: "unjudged", reason: "oversize" };
+    if (matcher === "" || matcher === "*")
+        return undefined;
+    const names = matcherLiteralNames(matcher);
+    if (names !== undefined) {
+        for (const [alias, canonical] of engineToolAliases()) {
+            if (names.includes(alias) && !names.includes(canonical))
+                return { kind: "dead", alias, canonical };
+        }
         return undefined;
-    const branches = matcher.split("|");
-    const aliases = engineToolAliases();
-    for (const branch of branches) {
-        const canonical = aliases.get(branch);
-        if (canonical !== undefined && !branches.includes(canonical))
-            return { alias: branch, canonical };
+    }
+    switch (depth) {
+        case "literal":
+            return undefined;
+        case "regex":
+            break;
+        default: {
+            const unreachable = depth;
+            return unreachable;
+        }
+    }
+    const selects = (name) => {
+        const verdict = matcherPatternMatchesWithin(matcher, name, budget);
+        return verdict === "invalid" ? "invalid_regex" : verdict;
+    };
+    for (const [alias, canonical] of engineToolAliases()) {
+        const selectsAlias = selects(alias);
+        if (typeof selectsAlias === "string")
+            return { kind: "unjudged", reason: selectsAlias };
+        if (!selectsAlias)
+            continue;
+        const selectsCanonical = selects(canonical);
+        if (typeof selectsCanonical === "string")
+            return { kind: "unjudged", reason: selectsCanonical };
+        if (!selectsCanonical)
+            return { kind: "dead", alias, canonical };
     }
     return undefined;
 }
-export function deadToolMatcherIssue(config) {
+export function buildDeadToolMatcherRefusal(issue) {
+    return {
+        message: `settings.hooks.${issue.event}: matcher "${issue.alias}" is an alias; tool-event matchers match the tool's wire name (PostToolUse / PostToolUseFailure since 7.107.0) — use "${issue.canonical}"`,
+        field: "settings.hooks",
+        detail: { event: issue.event, alias: issue.alias, canonical: issue.canonical },
+    };
+}
+export function deadToolMatcherIssue(config, depth, budget = {}) {
+    const now = budget.now ?? (() => performance.now());
+    const deadline = { deadlineMs: now() + (budget.budgetMs ?? ADMISSION_MATCHER_EVAL_BUDGET_MS), now };
     for (const [event, groups] of Object.entries(config)) {
+        if (!matcherReadsWireToolName(event))
+            continue;
         for (const group of groups ?? []) {
-            const dead = deadAliasInMatcher(event, group.matcher);
-            if (dead) {
-                return `settings.hooks.${event}: matcher "${dead.alias}" is an alias; tool-event matchers match the tool's wire name (PostToolUse / PostToolUseFailure since 7.107.0) — use "${dead.canonical}"`;
+            if (group.matcher === undefined)
+                continue;
+            const verdict = deadAliasInMatcher(group.matcher, depth, deadline);
+            if (verdict === undefined)
+                continue;
+            if (verdict.kind === "unjudged") {
+                recordFailOpen(MATCHER_UNJUDGED_TAG, `event=${event} reason=${verdict.reason} matcherChars=${group.matcher.length}`);
+                continue;
             }
+            return { event, alias: verdict.alias, canonical: verdict.canonical };
         }
     }
     return undefined;
@@ -144,9 +214,31 @@ export function parseHooksConfig(raw) {
     }
     return { config };
 }
-export function hookMatcherMatches(matcher, value) {
-    if (matcher === undefined || matcher === "" || matcher === "*")
-        return true;
+export function matcherLiteralNames(matcher) {
+    const names = [];
+    let first = -1;
+    let last = -1;
+    for (let i = 0; i <= matcher.length; i++) {
+        const c = i < matcher.length ? matcher.charCodeAt(i) : 0x7c;
+        if (c === 0x7c || c === 0x2c) {
+            if (first !== -1)
+                names.push(matcher.slice(first, last + 1));
+            first = -1;
+            last = -1;
+            continue;
+        }
+        if (c === 0x20)
+            continue;
+        const nameChar = (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a) || c === 0x5f || c === 0x2d;
+        if (!nameChar)
+            return undefined;
+        if (first === -1)
+            first = i;
+        last = i;
+    }
+    return names;
+}
+function matcherPatternMatches(matcher, value) {
     if (matcher === value)
         return true;
     try {
@@ -156,6 +248,14 @@ export function hookMatcherMatches(matcher, value) {
         return "invalid";
     }
 }
+export function hookMatcherMatches(matcher, value) {
+    if (matcher === undefined || matcher === "" || matcher === "*")
+        return true;
+    const names = matcherLiteralNames(matcher);
+    if (names !== undefined)
+        return names.includes(value);
+    return matcherPatternMatches(matcher, value);
+}
 export function hookIfMatches(cond, payload) {
     if (cond.length > 500 || (cond.match(/\*/g)?.length ?? 0) > 16)
         return "unevaluable";
@@ -762,6 +862,7 @@ export function createTaskHooks(config, ctx) {
             let currentInput = input;
             let rewritten = false;
             let asked;
+            let allowedFor;
             let unknownDecision = false;
             const contexts = [];
             const deadlineAt = Date.now() + MAX_HOOK_EVENT_TOTAL_SECONDS * 1000;
@@ -775,11 +876,12 @@ export function createTaskHooks(config, ctx) {
                 }
                 if (!m)
                     continue;
+                const groupInput = currentInput;
                 const payload = {
                     ...basePayload(ctx, tctx.permissionMode),
                     hook_event_name: "PreToolUse",
                     tool_name: toolName,
-                    tool_input: currentInput,
+                    tool_input: groupInput,
                     tool_use_id: tctx.toolCallId,
                 };
                 const singles = await runMatchingEntries("PreToolUse", [{ ...group, matcher: undefined }], toolName, payload, ctx, onceFired, deadlineAt, `PreToolUse:${gi}`);
@@ -820,10 +922,13 @@ export function createTaskHooks(config, ctx) {
                             asked = clip(typeof h.permissionDecisionReason === "string" ? h.permissionDecisionReason : "a PreToolUse hook requires approval", MAX_HOOK_FEEDBACK_CHARS);
                         }
                         if (decision === "allow" || decision === undefined) {
-                            if (h.updatedInput !== null && typeof h.updatedInput === "object") {
+                            const rewrites = h.updatedInput !== null && typeof h.updatedInput === "object";
+                            if (rewrites) {
                                 currentInput = h.updatedInput;
                                 rewritten = true;
                             }
+                            if (decision === "allow")
+                                allowedFor = { input: rewrites ? h.updatedInput : groupInput };
                         }
                         else if (decision !== "deny" && decision !== "ask") {
                             unknownDecision = true;
@@ -853,13 +958,11 @@ export function createTaskHooks(config, ctx) {
                     ...buildHookContextField(contexts),
                 };
             }
-            if (rewritten || contexts.length > 0) {
-                return {
-                    action: "allow",
-                    ...(rewritten ? { updatedInput: currentInput } : {}),
-                    ...buildHookContextField(contexts),
-                };
-            }
+            const carried = { ...(rewritten ? { updatedInput: currentInput } : {}), ...buildHookContextField(contexts) };
+            if (allowedFor !== undefined && allowedFor.input === currentInput)
+                return { action: "allow", ...carried };
+            if (rewritten || contexts.length > 0)
+                return carried;
             return undefined;
         };
         hooks.preToolUse = preToolUseHook;
@@ -1231,6 +1334,7 @@ export function composeHooks(deployment, task) {
             let current = input;
             const contexts = [];
             let asked;
+            let allowedFor;
             for (const slot of [d.preToolUse?.bind(d), t.preToolUse?.bind(t)]) {
                 if (!slot)
                     continue;
@@ -1250,6 +1354,10 @@ export function composeHooks(deployment, task) {
                         asked = r;
                         break;
                     case "allow":
+                        if (updatedInput !== undefined)
+                            current = updatedInput;
+                        allowedFor = { input: current };
+                        break;
                     case undefined:
                         if (updatedInput !== undefined)
                             current = updatedInput;
@@ -1269,13 +1377,11 @@ export function composeHooks(deployment, task) {
                     ...buildHookContextField(contexts),
                 };
             }
-            if (current !== input || contexts.length > 0) {
-                return {
-                    action: "allow",
-                    ...(current !== input ? { updatedInput: current } : {}),
-                    ...buildHookContextField(contexts),
-                };
-            }
+            const carried = { ...(current !== input ? { updatedInput: current } : {}), ...buildHookContextField(contexts) };
+            if (allowedFor !== undefined && allowedFor.input === current)
+                return { action: "allow", ...carried };
+            if (current !== input || contexts.length > 0)
+                return carried;
             return undefined;
         };
     }

package/dist/hosted-posture.d.ts

@@ -13,8 +13,8 @@
  *    比手抄的值更难发现烂掉,[ref] 的第一排查点就是它;
  *  · 能力授予面的赦免挂在 **`requirePrincipal !== true`** 上 —— 但**三条面各有各的谓词,不是一只**
  *    (异源复核实测,别照「它们都一样」写):
- *     · `settings.hooks` —— `boot/resolve-spec.ts` 的 hooks 臂,判据**只有** `config.requirePrincipal === true`
- *       ⇒ 忽略(**不看车道**,任何 `REMOTE_EXEC` 都一样);
+ *     · `settings.hooks` —— `task-settings.ts` 的 `taskHooksHonored`(唯一属主;resolve-spec 装配 / 受理面 / 能力位三处同调),判据**只有**
+ *       `requirePrincipal !== true` ⇒ 采纳,否则忽略(**不看车道**,任何 `REMOTE_EXEC` 都一样);
  *     · `additionalDirectories` / `additionalReadDirectories` —— **只有** `cwdHonored`
  *       (= `provider === "host" ∧ requirePrincipal !== true`);
  *     · `settings.env` / `cwd` —— `cwdHonored ‖ deviceCwdHonored`,而

package/dist/http/admission.js

@@ -2,12 +2,12 @@ import { isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
 import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
-import { deadToolMatcherIssue, parseHooksConfig } from "../hooks/hook-runner.js";
+import { buildDeadToolMatcherRefusal, deadToolMatcherIssue, parseHooksConfig } from "../hooks/hook-runner.js";
 import { judgeRequestWebSearch } from "../plugins/web-search.js";
 import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS, MAX_CWD_CHARS } from "../task-cwd.js";
@@ -200,9 +200,10 @@ export function createAdmission(ctx) {
                     sendError(res, 400, "request.field_invalid", hooksParsed.error ?? "settings.hooks: invalid shape");
                     return null;
                 }
-                const deadMatcher = deadToolMatcherIssue(hooksParsed.config);
+                const deadMatcher = deadToolMatcherIssue(hooksParsed.config, taskHooksHonored(deps.config) ? "regex" : "literal");
                 if (deadMatcher !== undefined) {
-                    sendError(res, 400, "request.field_invalid", deadMatcher);
+                    const refusal = buildDeadToolMatcherRefusal(deadMatcher);
+                    sendError(res, 400, "request.field_invalid", refusal.message, { field: refusal.field, detail: refusal.detail });
                     return null;
                 }
             }
@@ -420,6 +421,10 @@ export function createAdmission(ctx) {
                 sendError(res, 400, "request.field_invalid", "limits.budgetStreamCancel is not caller-settable here — the engine default applies (armed whenever a cost budget is present); remove it");
                 return null;
             }
+            if (l.brainCallGuardrailMs !== undefined) {
+                sendError(res, 400, "request.field_invalid", "limits.brainCallGuardrailMs is not caller-settable here — the engine's default wall on a single brain call applies (one hour); remove it");
+                return null;
+            }
             for (const k of ["maxWalltimeMs", "maxOutputTokens", "maxTurns"]) {
                 const v = l[k];
                 if (v !== undefined && (typeof v !== "number" || !Number.isInteger(v) || v < 1)) {

package/dist/http/approval-sweeps.js

@@ -7,6 +7,8 @@ import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import { hasServiceAuth } from "./dispatch.js";
 import { gatedPrincipal } from "./principal-gate.js";
 import { readinessOf, billableRefusalOf } from "./readiness.js";
+import { readResumeCtx } from "./resume-ctx-read.js";
+import { allowListReadingUnstated } from "./checkpoint-ctx.js";
 const BLOCKED_SCALAR_KEYS = ["errorCode", "blockedBy", "field", "reason", "count", "cap", "index"];
 function blockedScalars(body) {
     const out = {};
@@ -64,17 +66,35 @@ export function createApprovalSweeps(ctx) {
                 return false;
             }
         };
+        const allowListUnservable = async (sessionId) => {
+            const read = await readResumeCtx(cs.getCtx(sessionId));
+            if (read.kind === "corrupt")
+                return false;
+            return read.kind === "ok" && allowListReadingUnstated(read.ctx);
+        };
         let parkedSkipped = 0;
+        const allowListSkipped = [];
         for (const { sessionId } of expired) {
             if (await isParkedOwned(sessionId)) {
                 parkedSkipped += 1;
                 continue;
             }
+            if (await allowListUnservable(sessionId)) {
+                allowListSkipped.push(sessionId);
+                continue;
+            }
             await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied", { decidedBy: "sla_timeout" }).then((r) => { if (r.status >= 400)
                 deps.logger?.warn?.("deny_sweep_resume_blocked", { sessionId, status: r.status, ...blockedScalars(r.body) }); }, (e) => deps.logger?.warn?.("deny_sweep_resume_failed", { sessionId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) }));
         }
         if (parkedSkipped > 0)
             deps.logger?.info?.("deny_sweep_parked_skipped", { count: parkedSkipped });
+        if (allowListSkipped.length > 0) {
+            deps.logger?.warn?.("deny_sweep_allow_list_reading_skipped", {
+                count: allowListSkipped.length,
+                sessionIds: allowListSkipped,
+                note: "these expired approvals belong to tasks suspended by a server version that read settings.permissions.allow as a whitelist; this version does not replay them, so the SLA deny cannot be delivered. They stay suspended (session lock held) until the reaper collects them at their terminal time — cancel them (POST /v1/runs/:id/cancel) to release the sessions now",
+            });
+        }
     }
     async function redeemParkedAsk(req) {
         const cs = deps.checkpointStore;

package/dist/http/checkpoint-ctx.d.ts

@@ -0,0 +1,68 @@
+/**
+ * 续跑重建输入(`checkpoint_ctx` 的行体,{@link CheckpointCtx})的**写形**,以及持久化体里 `settings.permissions.allow` 的**读法记号** —— S-1034(7.115.0)。
+ *
+ * ## 病
+ * 7.115.0 把 `settings.permissions.allow` 从「名单」(名单外的工具一律拒)改成「allow 规则」(命中 = 带理由的放行,未命中 = 不表态、照常判)。
+ * 续跑家族重建 spec 时把**持久化的提交体**原样重放进 `resolveSpec`(`resume-legs.ts` 的 `resolveResumeSpec`)——
+ * 一条在 ≤7.114.0 上停驻、体里带非空 `allow` 的行,升级后续跑就被按新读法读:名单外的工具不再被拒。持久面上的静默语义翻转(放宽方向)。
+ * 坏形 `allow`(`Task` / `mcp__figma` / `Bash(npm:*)` …)的旧行则每次续跑都 409、SLA 拒扫腿逐拍重试直到收割 —— 一张本来放不开任何门的停驻被砖化。
+ *
+ * ## 规则(一条;持久数据的「响亮拒 + 一次性迁移」,零双读)
+ * 续跑重放持久化体之前问一句:**体里的 `allow` 在生效(非空数组)而本行没有「按表态读」的记号 ⇒ 拒**。
+ * 行留停驻、字节不动(拒发生在认领之前,run 行、卡、ctx 一个字节都不写);出路 = 作为新任务重提,这条任务若还停驻着先取消(`task_done` 唤醒停驻与 workflow 宿主那条腿没有可取消的 run)。
+ * **没有**「按旧名单语义继续读」的臂:那是第二种读法,正是本规则要消灭的东西。
+ *  · 记号 = ≥7.115.0 写下的行在体里带非空 `allow` 时,ctx 上的 `permissionsAllowReading: "statement"`(闭集一词)。
+ *    写点 = 每一次**新的**持久化写({@link buildCheckpointCtx} 是它们的唯一构造口);续跑腿的写回传的是读进来的那只 ctx(或其展开),记号随行,不重新判。
+ *  · 体里没有 `allow`(或空数组 —— 7.114.0 的名单判据 `acceptedRuleList` 对空数组同样读成「没有名单」)的行不写记号、不受本规则影响。
+ *
+ * ## 判据与 7.114.0 的关系(如实)
+ * 7.114.0 只在三桶整体合法时才读名单;判据这里只看「`allow` 是非空数组」,比 7.114.0 的「名单生效」宽一格(坏桶的行 7.114.0 也不读名单)——
+ * 方向 = 多拒,不会漏拒;而坏桶的体当年就被 fresh 受理门拒在门外,盘上本不该有。
+ *
+ * ## 何时删(一次性迁移,不是长期双读)
+ * 本判据、拒臂、记号写点与 `CheckpointCtx.permissionsAllowReading` 一起删,删除条件 = 所有 ≤7.114.0 停驻的行都已结束或被收割
+ * (停驻行的终局时刻 = 落盘起 `TERMINAL_BACKSTOP_MS`,见 `plugins/checkpoint-store-sql.ts`)之后的那个版本。删的时候记号的读者一起删:
+ * 届时盘上不会再有没记号却带 `allow` 的行,而有记号的行读不读它都一样。
+ */
+import type { CheckpointCtx } from "./route-ctx.js";
+import type { TaskRequestBody } from "./wire-types.js";
+/** 读法记号的闭集(一词):这一行体里的 `settings.permissions.allow` 是按「allow 规则(表态)」写下、也该按它读的。 */
+export declare const PERMISSIONS_ALLOW_READINGS: readonly ["statement"];
+export type PermissionsAllowReading = (typeof PERMISSIONS_ALLOW_READINGS)[number];
+/**
+ * 体里的 `settings.permissions.allow` 是否**在生效**:非空数组(与 7.114.0 名单判据 `acceptedRuleList` 同一个「在」——空数组 = 没有)。
+ * 入参是持久化的 JSON(可能来自任何旧版本),逐层判形,不信型面。
+ */
+export declare function bodyCarriesAllowList(body: TaskRequestBody): boolean;
+/**
+ * 一次**新的**持久化写的 ctx(提交腿 / `POST /v1/runs` 族 / leader worker)—— 写记号的唯一口。
+ *
+ * 调用方是「本进程刚按表态读过这份体」的写点:fresh 提交(受理门按 7.115.0 读过 `allow`),或已经过了续跑拒臂的重放腿
+ * (`startFreshHostTurn` 把宿主的存量体交给 `POST /v1/runs` 同一条链 —— 它在那之前调过 `resolveResumeSpecOrBlocked`,没记号却带 `allow` 的体到不了这里)。
+ * 续跑腿的**写回**不经本函数:它传读进来的 ctx(或其展开),记号随行;在写回口重新判会把一条没记号的旧行「洗」成新行。
+ */
+export declare function buildCheckpointCtx(fields: {
+    body: TaskRequestBody;
+    memoryScope?: string | undefined;
+    unattendedLeg?: true;
+}): CheckpointCtx;
+/**
+ * 本行能否被按 7.115.0 的读法重放:体里 `allow` 在生效而行上没有记号 ⇒ **不能**(`true` = 拒)。
+ * 记号的值不在闭集里(手改 / 将来的写者)⇒ 同样拒:认不得的记号不是证据。
+ */
+export declare function allowListReadingUnstated(ctx: CheckpointCtx): boolean;
+/**
+ * 拒的答复 —— 码与落点照「退役 mode-seed 行」的先例(`checkpoint.unsupported_version`,409,`retriable:true` = 那张卡仍 pending;**不是**「原样重试会成功」)。
+ * 拒在认领之前,所以没有 `taskId`(行没抢到就不造键)。句子说原因(这条任务停在 `allow` 还是名单的版本上)与出路(作为新任务重提,仍停驻的先取消;要「只许这些工具」用会话规则 `toolAllow` / 每请求 `excludeTools`)。
+ *
+ * 🔴 形是给冻结门看的(`api-error-text-freeze` 的 resume 家族收集器):`status: <三位数>, body: { error: "<整句双引号字面>", errorCode: "<码>"`,中间只许有空白。
+ */
+export declare function allowListReadingRefusal(): {
+    status: number;
+    body: {
+        error: string;
+        errorCode: string;
+        retriable: true;
+    };
+};
+//# sourceMappingURL=checkpoint-ctx.d.ts.map

package/dist/http/checkpoint-ctx.js

@@ -0,0 +1,36 @@
+export const PERMISSIONS_ALLOW_READINGS = ["statement"];
+export function bodyCarriesAllowList(body) {
+    const settings = body?.settings;
+    if (settings === null || typeof settings !== "object" || Array.isArray(settings))
+        return false;
+    const permissions = settings["permissions"];
+    if (permissions === null || typeof permissions !== "object" || Array.isArray(permissions))
+        return false;
+    const allow = permissions["allow"];
+    return Array.isArray(allow) && allow.length > 0;
+}
+export function buildCheckpointCtx(fields) {
+    return {
+        body: fields.body,
+        ...(fields.memoryScope !== undefined ? { memoryScope: fields.memoryScope } : {}),
+        ...(fields.unattendedLeg === true ? { unattendedLeg: true } : {}),
+        ...(bodyCarriesAllowList(fields.body) ? { permissionsAllowReading: "statement" } : {}),
+    };
+}
+export function allowListReadingUnstated(ctx) {
+    if (!bodyCarriesAllowList(ctx.body))
+        return false;
+    const reading = ctx.permissionsAllowReading;
+    return !(typeof reading === "string" && PERMISSIONS_ALLOW_READINGS.includes(reading));
+}
+export function allowListReadingRefusal() {
+    return {
+        status: 409,
+        body: {
+            error: "this task was suspended by an earlier server version, which read settings.permissions.allow as a whitelist (every tool not on the list was refused); this version reads that list as a statement that the named tools are allowed, not as a whitelist, so continuing would give the task more tools than it was submitted with. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel). To allow only certain tools, use the session rules' toolAllow (PUT /v1/sessions/:id/policy) or the request's excludeTools.",
+            errorCode: "checkpoint.unsupported_version",
+            retriable: true,
+        },
+    };
+}
+//# sourceMappingURL=checkpoint-ctx.js.map

package/dist/http/durable-run-leg.js

@@ -8,6 +8,7 @@ import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
+import { buildCheckpointCtx } from "./checkpoint-ctx.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { deps } = ctx;
     const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
@@ -31,7 +32,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
         return { status: placementReject.status, body: devicePlacementErrorBody(placementReject) };
     commitSessionInheritEnv(deps, args.prepared.spec.sessionId, args.prepared.body);
     if (deps.checkpointStore) {
-        await deps.checkpointStore.putCtx(sessionId, { body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope });
+        await deps.checkpointStore.putCtx(sessionId, buildCheckpointCtx({ body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope }));
     }
     const anchorOwner = args.prepared.auth?.principal ?? null;
     const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);

package/dist/http/resume-legs.js

@@ -42,6 +42,7 @@ import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
+import { allowListReadingRefusal, allowListReadingUnstated } from "./checkpoint-ctx.js";
 import { httpErrorCode } from "./send.js";
 function isCheckpointReopenedFailure(r) {
     const code = failureCodeOf(r.terminal);
@@ -398,7 +399,13 @@ export function createResumeLegs(ctx) {
         });
         return { spec, engineNotices };
     };
+    const refuseAllowListReading = (sessionId) => {
+        deps.logger?.warn?.("resume_refused_allow_list_reading", { sessionId, note: "this session's stored request carries settings.permissions.allow written by a server that read it as a whitelist; it is not replayed under the current reading — the task stays suspended until someone cancels it" });
+        return allowListReadingRefusal();
+    };
     const resolveResumeSpecOrBlocked = async (ctx, req, auth) => {
+        if (allowListReadingUnstated(ctx))
+            return { ok: false, answer: refuseAllowListReading(auth.sessionId) };
         try {
             const { spec, engineNotices } = await resolveResumeSpec(ctx, req, auth);
             return { ok: true, spec, engineNotices };
@@ -1332,6 +1339,8 @@ export function createResumeLegs(ctx) {
             return refuse(resumeCtxCorruptAnswer(ctxRead.where));
         if (ctxRead.kind === "absent")
             return refuse({ status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } });
+        if (allowListReadingUnstated(ctxRead.ctx))
+            return refuse(refuseAllowListReading(sessionId));
         return { ok: true, prepared: { sessionId, token, cp, ctx: ctxRead.ctx } };
     }
     async function drivePlanReview(prepared, decision, editedPlan, reason, req, acceptEarly, permissionModeAfter) {

package/dist/http/route-ctx.d.ts

@@ -161,6 +161,13 @@ export interface CheckpointCtx {
      * 传原 ctx / 其展开 ⇒ 标随行。缺席 = 不是无人值守腿(HTTP 提交腿;7.106.0 前落盘的行 —— 那时这些腿不铸模式,checkpoint 里也没有)。
      */
     unattendedLeg?: true;
+    /**
+     * 🔴 S-1034(7.115.0)—— 体里 `settings.permissions.allow` 的**读法记号**:在场 = 这一行是 ≥7.115.0 写下的、体里带非空 `allow`,
+     * 它按「allow 规则(表态)」写、也按它读。**服务端写、不来自请求体**(与 {@link unattendedLeg} 同为 `body` 的兄弟键)。
+     * 缺席而体里带非空 `allow` = ≤7.114.0 停驻的行(那时 `allow` 是名单)⇒ 续跑腿响亮拒、行字节不动(规则与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注)。
+     * 写点只有 `buildCheckpointCtx`(同模块;新的持久化写);续跑腿的写回传原 ctx / 其展开 ⇒ 记号随行。体里没有 `allow` 的行不写它。
+     */
+    permissionsAllowReading?: import("./checkpoint-ctx.js").PermissionsAllowReading;
 }
 /** B4①(命名化):`driveResumeIntoRunLog` 的入参形(resume 家族共用)——原为 9 成员内联匿名对象。 */
 export interface DriveResumeArgs {

package/dist/http/routes/a2a-serve.d.ts

@@ -1,5 +1,5 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { type A2ATaskState } from "@sema-agent/core";
+import type { A2ATaskState } from "@sema-agent/core";
 import type { A2aServeConfig } from "../../config-types.js";
 import { type RunRecord } from "../../plugins/store-contracts.js";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
@@ -69,8 +69,6 @@ export declare function a2aStateForRun(run: Pick<RunRecord, "status" | "errorCod
  * `capabilities.a2aServe` 的子串,好让 `route-shape-roster` 层E 如实认出它们。
  */
 export declare function handleA2a(req: IncomingMessage, res: ServerResponse, match: RouteMatch<A2aRpcRouteId>, ctx: RouteCtx): Promise<void>;
-/** 九词闭集的对外可见锚(测试用它证明我们只发闭集词;也让「加一个自造词」在这里就被看见)。 */
-export declare const A2A_SERVE_TASK_STATES: readonly A2ATaskState[];
 export declare const A2A_SERVE_ROUTES: readonly [{
     readonly id: "a2a-agent-card";
     readonly path: "/.well-known/agent-card.json";

package/dist/http/routes/a2a-serve.js

@@ -1,7 +1,6 @@
 import { persistedPlaneOf } from "../../terminal.js";
 import { createHash } from "node:crypto";
 import { memoRedactedRead, redactErrorMessage } from "../../observability/run-terminal.js";
-import { A2A_TASK_STATES } from "@sema-agent/core";
 import { isParkedRunStatus, isTerminalRunStatus } from "../../plugins/store-contracts.js";
 import { HttpError } from "../../security.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
@@ -396,7 +395,6 @@ export async function handleA2a(req, res, match, ctx) {
 function sendRpc(res, body) {
     sendJson(res, 200, body);
 }
-export const A2A_SERVE_TASK_STATES = A2A_TASK_STATES;
 export const A2A_SERVE_ROUTES = [
     { id: "a2a-agent-card", path: "/.well-known/agent-card.json", methods: ["GET"] },
 ];

package/dist/http/routes/admin-memory-optout.d.ts

@@ -42,8 +42,6 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 export declare const ADMIN_MEMORY_OPTOUT_PATH = "/v1/admin/memory-optout";
-/** 带参口(`:principal`)⇒ 路由声明表(`http/route-table.ts`)里走 `pattern` 行,不是 `path` 行。 */
-export declare const ADMIN_MEMORY_OPTOUT_OVERRIDE_RE: RegExp;
 export declare function handleMemoryOptOut(req: IncomingMessage, res: ServerResponse, match: RouteMatch<MemoryOptOutRouteId>, ctx: RouteCtx): Promise<void>;
 export declare const MEMORY_OPTOUT_ROUTES: readonly [{
     readonly id: "memory-optout-grants-list";

package/dist/http/routes/admin-memory-optout.js

@@ -4,7 +4,6 @@ import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../pri
 import { assertNever } from "../route-ctx.js";
 import { memoryOptOutPrincipalShapeProblem } from "../../plugins/memory-optout-grant-store-sql.js";
 export const ADMIN_MEMORY_OPTOUT_PATH = "/v1/admin/memory-optout";
-export const ADMIN_MEMORY_OPTOUT_OVERRIDE_RE = /^\/v1\/admin\/memory-optout\/([^/]+)$/;
 const PutBodySchema = z.object({ allow: z.boolean(), note: z.string().min(1).max(500).optional() }).strict();
 export async function handleMemoryOptOut(req, res, match, ctx) {
     const { deps } = ctx;

package/dist/http/routes/capabilities.js

@@ -24,7 +24,7 @@ import { projectApprovalsStreamLiveCapability } from "../../capabilities/approva
 import { workflowModelAllowlistFor, selfOrchestrationDenial } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
-import { coercePermissionModeStrict, SETTINGS_PERMISSION_MODE_WORDS } from "../../task-settings.js";
+import { coercePermissionModeStrict, SETTINGS_PERMISSION_MODE_WORDS, taskHooksHonored } from "../../task-settings.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { sessionBackgroundFacesAvailable } from "./background.js";
 function routePairingOf(deps, name, m) {
@@ -121,7 +121,8 @@ export async function handleCapabilities(req, res, match, ctx) {
                 scratchpadDir: true,
                 subagentSteer: Boolean(deps.subagentSteerRegistry) && Boolean(deps.runStore),
                 subagentResume: Boolean(deps.subagentSteerRegistry) && Boolean(deps.runStore),
-                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: deps.config.requirePrincipal !== true },
+                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: taskHooksHonored(deps.config) },
+                settings: { permissions: { allowGrant: true } },
                 permissionModeAuto: {
                     accepted: true,
                     classifierSeat: deps.autoModeFace?.seatMounted === true,

package/dist/http/routes/diagnostics.d.ts

@@ -32,6 +32,9 @@ export interface ServerWiringGates {
     streamAskWindowMs: PostureKnobReading<number>;
     sessionAutoTitle: PostureKnobReading<boolean>;
     checkpointStore: boolean;
+    /** 7.115.0:运维的 allow 规则(`APPROVAL_GRANT`)原样 —— 空表 = 旋钮未设。规则名是工具名不是秘密,所以本面给全名单(条数 = 长度);
+     *  本位**只**在运维面(operator-only,门在路由上),不进 `/v1/capabilities` 的客户端能力位:它说的是部署替谁表了态,不是调用方能用什么。 */
+    approvalGrant: readonly string[];
 }
 /** `buildServerWiringGates` 的入参 = 三个谓词各自的**真输入**(不接受已算好的布尔:那样这里读到的就
  *  不再是装配现场的事实,而是别处算完可能已漂的复述)。 */
@@ -49,6 +52,8 @@ export interface ServerWiringGateInput {
     streamAskWindowMsSource: PostureSource;
     sessionAutoTitle: boolean;
     sessionAutoTitleSource: PostureSource;
+    /** 7.115.0:`config.approvalGrant` 本身(读面不重算)。 */
+    approvalGrant: readonly string[];
 }
 /** 纯数据产物(`build*`):三个门的当前读数。`streamApproval` 走**单一谓词**
  *  `resolveStreamApprovalGate` —— 与 `/v1/capabilities` 的 `streamApproval` 位、与回决口的 501 门同一个