@sema-agent/server 7.114.0 → 7.115.0

package/dist/model-entry-refusal.d.ts

@@ -90,13 +90,21 @@ export interface ModelRefusalVerdict {
  * 名 → 码,**值只码**(拒因事实里的上游 id / provider 词 / 坏字段键 / 出路句都不上 wire —— `entry_invalid` 行是没人验过的行,id / provider
  * 可能就是坏行原样;句子是给本机运维的散文,不是契约)。**名筛在这里、只在这里**:键过 settings-schema `isReportableRefusalName`(唯一判据,
  * import 不复制;6.3.0 起 = 标识符白名单 ∧ 无密钥形 ∧ 无 URL userinfo)—— 秘密形 / 空串 / `__proto__` / 不是标识符的串这类出不了门的名不进键、
- * 不计数;引擎内部的判决不受影响(本机日志的写名行为与基线同)。
+ * 不计数;引擎内部的判决不受影响;本机日志 / 拒因句里的写名同样先问这一只(S-805,{@link disclosableRefusalName}:不可披露的名只写码)。
  * 逐条空且无组拒 ⇒ `undefined`(键缺席:「没有」只有一种拼法)。
  */
 export declare function buildModelRefusalsSignal(v: ModelRefusalVerdict | undefined): ModelRefusalsSignal | undefined;
+/**
+ * 一个被拒条目名的**日志字段**:可披露 ⇒ `{ [key]: name }`;不可披露 ⇒ `{ [`${key}NameWithheld`]: true }`(缺 `key` 不是无声的:读日志的人知道是被扣下、
+ * 不是漏写)。**所有**把被拒条目名写进结构化日志字段的站点调这一只(`refusalWarnFields` / `apply-effective.ts` 的角色与档位绑定 warn、缺省悬空 warn),
+ * 不各写一份 `isReportableRefusalName` 判断。
+ */
+export declare function refusedNameLogField(key: string, name: string): Record<string, unknown>;
+/** 一串被拒条目名的日志字段(`sema_registry_models` 行的 `unavailable`):只列可披露的名,被扣下的名**只数个数**(`<key>NamesWithheld`,0 个时键缺席)。 */
+export declare function refusedNamesLogFields(key: string, names: readonly string[]): Record<string, unknown>;
 /** 成因 → 它那一条 warn 的事件名(**穷举**)。两个名字是票面点名的既有/新事件,运维的告警规则按名挂。 */
 export declare function refusalEventOf(reason: ModelEntryRefusalReason): "sema_registry_model_no_brain" | "sema_registry_model_entry_invalid";
-/** warn 字段(不含值):`field` = 第一处坏字段(告警规则最常按它分组),`fields` = 全部。 */
+/** warn 字段(不含值):`field` = 第一处坏字段(告警规则最常按它分组),`fields` = 全部。S-805:`model` 只在名可披露时写。 */
 export declare function refusalWarnFields(name: string, r: ModelEntryRefusal): Record<string, unknown>;
 /**
  * 一次**显式选择**命中了不可用条目时的拒因句(HTTP `request.model_unavailable` 的 `error`、run-local 的 stderr、

package/dist/model-entry-refusal.js

@@ -94,6 +94,22 @@ export function buildModelRefusalsSignal(v) {
         return undefined;
     return v.plane === undefined ? { entries } : { entries, plane: v.plane };
 }
+function disclosableRefusalName(name) {
+    return isReportableRefusalName(name) ? name : undefined;
+}
+export function refusedNameLogField(key, name) {
+    const shown = disclosableRefusalName(name);
+    return shown !== undefined ? { [key]: shown } : { [`${key}NameWithheld`]: true };
+}
+export function refusedNamesLogFields(key, names) {
+    const shown = names.filter((n) => disclosableRefusalName(n) !== undefined);
+    const withheld = names.length - shown.length;
+    return { [key]: shown, ...(withheld > 0 ? { [`${key}NamesWithheld`]: withheld } : {}) };
+}
+function nameSlot(name) {
+    const shown = disclosableRefusalName(name);
+    return shown === undefined ? "(name withheld)" : `"${shown}"`;
+}
 export function refusalEventOf(reason) {
     switch (reason) {
         case "no_brain":
@@ -104,7 +120,7 @@ export function refusalEventOf(reason) {
 }
 export function refusalWarnFields(name, r) {
     return {
-        model: name,
+        ...refusedNameLogField("model", name),
         provider: r.provider,
         code: r.code,
         ...(r.fields.length > 0 ? { field: r.fields[0], fields: [...r.fields] } : {}),
@@ -118,7 +134,7 @@ export function modelUnavailableMessage(field, requested, name, r) {
 export function defaultModelRefusal(view, leg) {
     if (Object.hasOwn(view.models, DEFAULT_MODEL_REF) && view.models[DEFAULT_MODEL_REF] !== undefined)
         return undefined;
-    const refused = Object.entries(view.modelRefusals).map(([n, r]) => `"${n}" [${r.code}]`);
+    const refused = Object.entries(view.modelRefusals).map(([n, r]) => `${nameSlot(n)} [${r.code}]`);
     const unavailable = refused.length > 0 ? ` (every enabled catalog entry is unavailable on this host: ${refused.join(", ")})` : "";
     switch (leg) {
         case "env":
@@ -163,7 +179,7 @@ export function refusedNameMintedRefusal(view) {
     const minted = mintedRefusedNames(view);
     if (minted.length === 0)
         return undefined;
-    const pairs = minted.map((m) => `"${m.name}" [${m.code}] → "${m.target}" (${m.via})`);
+    const pairs = minted.map((m) => `${nameSlot(m.name)} [${m.code}] → ${nameSlot(m.target)} (${m.via})`);
     return (`unavailable catalog entries would be re-minted onto other entries by the tier/alias expansion [${REFUSED_NAME_MINTED_CODE}]: ${pairs.join(", ")} — ` +
         "an explicit pick of that name (or a role bound to it) would silently run on the other entry's endpoint and account; " +
         "rename the unavailable entry, fix it (see its own warn), or rebind / drop the tier binding that mints the name.");

package/dist/observability/fail-open.d.ts

@@ -1,13 +1,10 @@
 import type { Logger } from "./logger.js";
 import type { Metrics } from "./metrics.js";
-/** 登记项:`cls` 是判据表的分类(见模块头——只有这两类允许走本封装),`note` 说清"放行的最坏后果"。 */
-export interface FailOpenTagEntry {
-    /** `F`=纯体验/缓存回退,放行最坏后果只是"难看/不够好";`P-DEBT`=保护型欠账,方向明知不对、显式记债。 */
-    readonly cls: "F" | "P-DEBT";
-    /** 这条兜底放行了什么、最坏后果是什么。写给未来读遥测的人,不写来历。 */
-    readonly note: string;
-}
-/** 闭集 tag 词表。形=`<repo>.<domain>.<site>`(跨仓同形,便于三仓遥测并表)。 */
+/**
+ * 闭集 tag 词表。形=`<repo>.<domain>.<site>`(跨仓同形,便于三仓遥测并表)。
+ * 每项 `{ cls, note }`:`cls` 是判据表的分类(见模块头——只有这两类允许走本封装):`F`=纯体验/缓存回退,放行最坏后果只是"难看/不够好";
+ * `P-DEBT`=保护型欠账,方向明知不对、显式记债。`note` 说清这条兜底放行了什么、最坏后果是什么(写给未来读遥测的人,不写来历)。
+ */
 export declare const FAIL_OPEN_TAGS: {
     readonly "server.approval-ask-journal.compaction-failed": {
         readonly cls: "F";

package/dist/permission-rule-list.d.ts

@@ -0,0 +1,81 @@
+/**
+ * **规则表的唯一编译口** —— 一张工具名规则表(`allow` / `ask` / `deny` 之一)编成一只 `ToolPolicy`。
+ *
+ * 两类读者,同一只编译口(编译与校验各只有一份,不在别处另写第二份文法):
+ *  · 请求腿的 `settings.permissions.{allow,ask,deny}` 三桶(`task-settings.ts` 的 `deriveSettingsPolicy`);
+ *  · 运维的 allow 规则 `APPROVAL_GRANT`(`runtime-governance.ts` 的 `applyRuntimeGovernance`,经部署治理链的单一构造口
+ *    `deployment-governance.ts` 交进来 —— HTTP 提交 / durable 续跑 / 停驻后台 agent 的跨副本赎回 / run-local 四条腿同装)。
+ *
+ * 为什么住在一只叶模块里(不留在 `task-settings.ts`):运维那一侧的启动校验在 `config.ts` 里跑(坏值 = 拒启),而
+ * `task-settings.ts` 值引 `config.ts` —— 编译口留在那里,`config.ts` 要调它就闭合一只 ESM 装载环。本模块只 import core 与
+ * `text-bidi.ts`(纯叶),三处读者引它都不成环。
+ */
+import { type PathRuleBases, type RuleBehavior, type ToolPolicy } from "@sema-agent/core";
+/** 一张表里规则条数的上限 —— 请求腿 wire 门(`task-settings.ts` 的三桶判形)读的也是这一个名字:core 的缺省帽是 256,
+ *  不对齐的话第 257 条起编译当场抛,等于服务端自己收下的东西自己反悔。 */
+export declare const MAX_PERMISSION_RULES_PER_LIST = 1000;
+/** A name-keyed rule-list ToolPolicy: a tool named by `names` gets `behavior` (an `allow` hit states the allow with
+ *  `decisionReason: "rule"`; `ask` tightens to an approval gate; `deny` hard-blocks); every other tool is out of
+ *  scope (`defaultAction: "allow"` = this policy has no opinion about anything it does not name). Composed deny-wins
+ *  with the rest of the fold, so `ask` / `deny` only ever tighten and an `allow` never overrides a deny or an ask.
+ *
+ *  `source` = 这张表**写在哪**(请求腿 `settings.permissions.<桶>`;运维腿 `APPROVAL_GRANT`)。它盖进每条规则(core 的 deny / ask
+ *  句里点名它:`flagged by permission rule "mcp__figma__*" (settings.permissions.ask)`),编不出来时的错误句也点名它;只是出处,
+ *  不带任何优先级(层序在各自的折叠里)。
+ *
+ * 🔴 [ref] / core [ref] —— 本函数曾是 `new Set(askNames).has(req.toolName)` 的**逐字**比对,那是
+ *  **安全轴上的静默 fail-open**:CC 自家 settings validator 推荐的 covering 拼法
+ *  (`"MCP rules do not support patterns in parentheses … use mcp__srv__*"`)在逐字比对下永远配不上真工具名
+ *  `mcp__figma__get_file` ⇒ 一次不问、直跑、审计静音。两道兜底也各自放行:`unmatchableToolNamesRefusal`
+ *  对 `mcp__<peer>__*` 判「合法 MCP 全名」(server 不持挂载表,动态宇宙不能按名单否定),`nameSets` 审计面
+ *  报的是「没匹配上的名字」而 covering 名在 core 眼里**是**匹配得上的。同一份 settings 里
+ *  `deny:["mcp__figma__*"]` 却**真拦** —— deny 走 `createAllowDenyPolicy`,它用的是 core 的
+ *  `namespacedCoveringEntries/Hit`。同族分家,差的只是解析器。
+ *
+ *  ⇒ **规则表的 policy 面现在同源**:三种态度都由 `createPermissionRulePolicy` 的 covering 车道解,底下是
+ *  core 的**同一只** `namespacedRuleNameCovers`(协议无关:`mcp__`/`a2a__` 同解;peer 段精确比;工具段 `*`/glob 覆盖)。
+ *  本仓**不自写第二套 glob** —— 那正是当年分家的成因。
+ *
+ *  ⚠️ 「同源」的**射程**说准了免得下一个人当成全仓结论(codex 交叉轮 finding-1 追出来的边):
+ *   · 同源的是**本编译口**认的 covering。表**进门前**还有一道更外层的判据(`config.ts` 的 `unmatchableToolNamesRefusal`,
+ *     请求腿经 `task-settings.ts` 的 `rejectUnmatchableSettingsNames`、运维腿经 `config.ts` 的 `approvalGrantRefusal`),它把
+ *     `<ns>__<peer>` **两段形**(`mcp__figma`)判成「缺段名」拒掉 —— 而 core 三只 policy 都认这个形(实测:
+ *     `createAllowDenyPolicy`/`createPermissionRulePolicy`/`createApprovalPolicy` 对 `mcp__figma` 一律解成 covering)。
+ *     所以各表收 `mcp__figma__*`(等价、且被推荐)、拒 `mcp__figma`。
+ *   · **同源的射程已扩到 operator 名单腿**([ref] 孪生修,[ref]):`createDurableAskPolicy`(`src/approval.ts`)的
+ *     deny/neverAuto/require 三集合过去是逐字 `Set.has`,自 core 5.60.1 谓词根导出后改成「精确 ∪ covering」,用的是
+ *     **同一只** `namespacedRuleNameCovers`。⇒ env `APPROVAL_*` 腿 / 中心下发 `runtime.approvalRequire` 腿 / 规则表三家
+ *     现在对 covering 拼法的解读逐字一致,`mcp__figma__*` 在哪条腿上都是真判。
+ *   · **两段形为什么仍不放开**(理由已换,别再引「approval.ts 还不认」):它一名两义——「整台服务器」与「三段名写漏一段」
+ *     在 boot 期不可分辨,所以各条腿一律响亮拒 + 指引给无歧义的 `mcp__figma__*`。放宽是各腿同时变宽的 behavior-facing
+ *     改动,走独立批的三问。详见 `unmatchableToolNamesRefusal` 顶注。
+ *
+ *  三处刻意的取舍,都是亲读 core dist 后定的:
+ *   · `onInvalidRule:"throw"`(缺省)—— 一条编不出来的规则整表拒(请求腿 → resolve-spec 翻 422;运维腿 → 拒启),抛之前补上
+ *     出处名(core 的原文只说 "createPermissionRulePolicy: …",不说是哪张表出的错)。[ref] 的括号形在**更外层**已被拒,够不着
+ *     这里;真正新增的是「名字里带反斜杠」「单条 > 512 字符」这两族永不匹配的拼法。
+ *     ✅ **不对称已收口([ref]①,[ref] 销)**:codex finding-2 当年如实登记的「同样两族拼法在 `deny`
+ *     上仍是静默 no-op」已修 —— 判据搬进单点成文的 `unmatchableToolNamesRefusal`,它拿 core 自己的 `validatePermissionRules`
+ *     对同一串跑一遍文法(不自铸第二套判词),于是三张表对这两族说同一句话。S-654 (c) 起 `allow` 也收。
+ *     ⚠️ 存量 resume:带这两族拼法的**已存 body** 在 resume 腿会 422(resolve-spec 翻)。这**不是**新造的姿态——A3
+ *     (`rejectUnmatchableSettingsNames`)早就对存量 body 里的退役名/短名同样抛,且 `applyTaskSettings` 腿有专门的回归钉。
+ *     判据同一条:一个**静默不存在的审批门**比一次响亮失败更贵。codex 建议的「给非法存量条目保留旧的逐字比对」被**驳回**:
+ *     那正是把 fail-open 请回来。
+ *   · `caps.maxRules` 对齐 {@link MAX_PERMISSION_RULES_PER_LIST}(理由见那只常量)。core 的 set-level cap 连 `skip` 都照抛,
+ *     所以运维腿的启动校验还要**试编一次**(`approvalGrantRefusal`)才拦得住超帽 —— 判据仍是本函数这一只。
+ *   · 不再自铸 `decisionReason:"rule"` —— core 的规则策略本就不铸这个键(allow 命中由 core 自己铸 `"rule"`),且 core 侧唯一区分它的
+ *     两处(prepare-task 的继承 grant 复用判据、park 的 rule-suggestion 门)对 `"rule"` 与 `undefined` **同待**(只把 `"hook"`
+ *     排除在外),dist 亲读在案。审计归因改由 `matchedAskRule` + `source` 承担,后者比前者强:它还让 core 的 auto-mode 分类器
+ *     **拒绝**替人清掉这条 ask(「运维写下的『每次问我』不是分类器的犹豫」),方向是收紧。
+ *
+ * 🔴 **S-654 (c)(7.115.0,core 7.40.0 #1065):三种态度同一个编译口,`allow` 也走这里** —— `behavior: "allow"` 的规则命中 = core 带
+ *  `decisionReason: "rule"` 的放行 —— allow 规则给出「有人表态」—— 它回答的是没人表态的服务器工具 / A2A 技能调用;内置工具上引擎自己的写门、shell 检查照问,deny / ask 照赢(与参照实现的 `permissions.allow` 在内置工具上**不同**:那边 `allow: ["Edit"]` 跳过编辑确认,这里不放掉引擎的写门);未命中 = `defaultAction: "allow"` 的裸 allow
+ *  = 不表态、照常判。修前请求腿的 allow 编成 `createAllowDenyPolicy({ allow })` 的**名单**(名单在场 ⇒ 名单外的工具一律拒),与写它的人要的
+ *  「替这些工具表态」方向相反;终端因此从不投这只桶。core 7.40.0 起没人表态的服务器工具调用要问,allow 规则就是那张卡的常设答案
+ *  (`mcp__<server>__*` 一条覆盖整台服务器)。allow 规则**不越过** deny / ask:折叠 deny > ask > allow,任何一层的 deny / ask 照赢;
+ *  它只在没人反对时给出那句表态。core 的 allow 文法只收工具名形(精确名 / `mcp__`·`a2a__` covering 形),内容形放行(`Bash(npm:*)` /
+ *  `Edit(src/**)` / 参数级)core 拒编,两条腿与 deny / ask 同一个出口(判据 `unmatchableToolNamesRefusal`)。
+ *  7.115.0 起运维的 `APPROVAL_GRANT` 也编在这里(无人值守腿没有请求体,那是运维为自己接的服务器表态的唯一位置)。 */
+/** `behavior` = 这张表的态度 —— 型直接是 core 的 `RuleBehavior`(不手抄:core 加一种态度,这里与它同步、读者 tsc 上见到)。 */
+export declare function createRuleListPolicy(names: readonly string[], behavior: RuleBehavior, source: string, pathBases: PathRuleBases | undefined): ToolPolicy;
+//# sourceMappingURL=permission-rule-list.d.ts.map

package/dist/permission-rule-list.js

@@ -0,0 +1,17 @@
+import { createPermissionRulePolicy } from "@sema-agent/core";
+import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+export const MAX_PERMISSION_RULES_PER_LIST = 1_000;
+export function createRuleListPolicy(names, behavior, source, pathBases) {
+    try {
+        return createPermissionRulePolicy(names.map((name) => ({ rule: name, behavior, source })), {
+            defaultAction: "allow",
+            caps: { maxRules: MAX_PERMISSION_RULES_PER_LIST },
+            ...(pathBases !== undefined ? { pathBases } : {}),
+        });
+    }
+    catch (e) {
+        const coreMsg = (e instanceof Error ? e.message : String(e)).replace(CONTROL_AND_BIDI_STRIP_RE, "");
+        throw new Error(`${source.replace("settings.", "")} has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
+    }
+}
+//# sourceMappingURL=permission-rule-list.js.map

package/dist/run-local.js

@@ -12,7 +12,7 @@ import { singleUserAutoAcceptBaselineApplies } from "./approval.js";
 import { withUnattendedLeg } from "./unattended-permission-mode.js";
 import { buildUnattendedPolicyRefusal } from "./tool-approval.js";
 import { createBrain } from "./brain.js";
-import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "./deployment-governance.js";
+import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, buildApprovalGrantNotice, createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "./deployment-governance.js";
 import { applyRuntimeGovernance } from "./runtime-governance.js";
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { taskWallClockSec } from "./task-workflow.js";
@@ -334,6 +334,9 @@ export async function runLocal(argv, deps = {}) {
     });
     if (ungatedCompensation)
         logger.warn(ungatedCompensation.event, ungatedCompensation.fields);
+    const approvalGrantNotice = buildApprovalGrantNotice(config);
+    if (approvalGrantNotice)
+        logger.info(approvalGrantNotice.event, approvalGrantNotice.fields);
     if (!deps.brain) {
         const missing = missingGatewayRequirements(config);
         if (missing.length > 0) {

package/dist/runtime-governance.d.ts

@@ -97,6 +97,19 @@ export declare function validateCommandRules(rules: CommandRule[]): string[];
  * 闭集本身则由契约 zod 派生 ⇒ 契约加一个判词,`RANK` 与桶分配的穷尽 switch 双双**编译红**。
  */
 export declare function compileCommandPolicyLayers(rules: CommandRule[] | undefined): ToolPolicy[];
+/** 运维 allow 规则表的出处名 = 它的 env 名(盖进每条规则;编不出来 / 不合文法时拒启句的主语)。 */
+export declare const APPROVAL_GRANT_SOURCE = "APPROVAL_GRANT";
+/**
+ * 7.115.0 —— 运维的 allow 规则(`APPROVAL_GRANT`)编成治理层的**叶**(空 / 缺席 ⇒ `[]`,本层一片叶都不铸,折叠逐字与修前同)。
+ *
+ * 编译口是**请求腿 `settings.permissions.allow` 的同一只**(`permission-rule-list.ts` `createRuleListPolicy`,`behavior: "allow"`):命中 = core 带
+ * `decisionReason: "rule"` 的放行(折叠把这句表态带到终局,引擎据此不再为没人表态的服务器工具调用出 `unstated` 卡);未命中 = 裸 allow =
+ * 不表态。它是一片**不收紧**的叶 —— 与 commandPolicy / 守卫集同住一个折叠点,只因为三者是同一个「部署说的话」:折叠 deny > ask > allow,
+ * 同折叠里任何一片叶的 deny / ask、`tightenTaskSpec` 之下的审批基线、之上的请求 settings 与会话规则,照旧压过它。
+ *
+ * 启动校验(`config.ts` `approvalGrantRefusal`)试编的也是本函数 —— 拒启判据与运行期编译是同一只,不会出现「启动收下、任务里编不出来」。
+ */
+export declare function compileApprovalGrantLayers(grant: readonly string[] | undefined): ToolPolicy[];
 /**
  * Expand an autonomy mode into TIGHTEN-ONLY `TaskSpec` safety overrides (the primitives — TRAP #2):
  *  - `read-only` / `plan` → `handsReadOnly: true` **+ `writeFace: "roots"`** (read + propose, never mutate; the
@@ -203,13 +216,18 @@ export declare function governanceOriginOf(gate: {
     };
 } | undefined, governance: GovernancePosture | undefined): true | undefined;
 /**
- * Apply the operator's runtime governance (autonomy + commandPolicy + manualModeShellGate) onto a base
+ * Apply the operator's runtime governance (autonomy + commandPolicy + manualModeShellGate + the guard set + the
+ * `APPROVAL_GRANT` allow rules) onto a base
  * `TaskSpec`, TIGHTEN-ONLY, in a SINGLE {@link tightenTaskSpec} call: commandPolicy compiles to a `toolPolicy`
  * override (combined onto the baseline by `tightenTaskSpec` — TRAP #1), and autonomy expands to
  * `handsReadOnly` / `shellGate` overrides (TRAP #2). `tightenTaskSpec` THROWS `TaskSpecTightenError` if any
  * override would LOOSEN a stricter base safety field — surfacing a misconfiguration loudly instead of silently
  * weakening the gate. Returns `base` untouched when there is nothing to apply.
  *
+ * 7.115.0:`APPROVAL_GRANT` 是这里唯一一片**不收紧**的叶 —— 它只给出 allow 的那句表态(core 7.40.0 起没人表态的服务器工具调用要问,
+ * 运维的规则就是那句答),从不清掉任何 deny / ask:折叠 deny > ask > allow,所以「部署 ⊇ 操作员 ⊇ 客户端只能收窄」的不变量逐字成立。
+ * 编译口与请求腿的 allow 桶同一只({@link compileApprovalGrantLayers})。
+ *
  * [ref]([ref] server 分单②):`MANUAL_MODE_SHELL_GATE` 从 settings 折叠搬到这里**无条件施加**。旧家
  * (task-settings deriveSettingsPolicy 的 default/auto/acceptEdits 三臂)让一个**部署级 tighten-only 旋钮
  * 的生死由客户端表态在场性决定**:body 无 settings/permissionMode(cli print/headless 腿按设计不 stamp)
@@ -242,6 +260,8 @@ export declare function applyRuntimeGovernance(base: TaskSpec, governance: {
     /** 守卫集的**叶**(`deployment-governance.ts` `createDeploymentGovernanceInputs` 预铸;S-958 起是叶的列表,不是一只预折的策略)。
      *  空列表与缺席同义。 */
     sensitivePathLayers?: readonly ToolPolicy[];
+    /** 7.115.0:运维的 allow 规则(`APPROVAL_GRANT` 原串;本函数经 {@link compileApprovalGrantLayers} 编成叶)。空列表与缺席同义。 */
+    approvalGrant?: readonly string[];
     /** [ref]/[ref] `governanceForced` 的标记表(缺省 = **当前 run 腿的 ALS 表**,见
      *  `governance-ask-marks.ts` 顶注「作用域」段)。注入口只为测试与将来的多实例形。 */
     askMarks?: GovernanceAskMarks;

package/dist/runtime-governance.js

@@ -2,6 +2,7 @@ import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createC
 import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
 import { createDeploymentAuthoredPolicy, operatorAsk } from "./operator-ask.js";
+import { createRuleListPolicy } from "./permission-rule-list.js";
 import { heldRuleName } from "./tool-rule-names.js";
 const COMMAND_RULE_SHAPE = GovernanceConfig.shape.commandPolicy.unwrap().element.shape;
 const COMMAND_DECISIONS = COMMAND_RULE_SHAPE.decision.options;
@@ -100,6 +101,10 @@ export function compileCommandPolicyLayers(rules) {
     }
     return policies;
 }
+export const APPROVAL_GRANT_SOURCE = "APPROVAL_GRANT";
+export function compileApprovalGrantLayers(grant) {
+    return grant !== undefined && grant.length > 0 ? [createRuleListPolicy(grant, "allow", APPROVAL_GRANT_SOURCE, undefined)] : [];
+}
 export function autonomyOverrides(autonomy) {
     switch (autonomy) {
         case "read-only":
@@ -143,7 +148,7 @@ function createGovernanceShellGateMarkPolicy(marksOf, tools = COARSE_SHELL_TOOLS
 export function applyRuntimeGovernance(base, governance) {
     const marksOf = () => governance.askMarks ?? currentGovernanceAskMarks();
     const overrides = { ...autonomyOverrides(governance.autonomy) };
-    const layers = [...compileCommandPolicyLayers(governance.commandPolicy), ...(governance.sensitivePathLayers ?? [])];
+    const layers = [...compileCommandPolicyLayers(governance.commandPolicy), ...(governance.sensitivePathLayers ?? []), ...compileApprovalGrantLayers(governance.approvalGrant)];
     const governancePolicy = layers.length > 0 ? createGovernanceAskMarkingPolicy(combinePolicies(...layers.map(createDeploymentAuthoredPolicy)), marksOf) : undefined;
     if (governancePolicy !== undefined)
         overrides.toolPolicy = governancePolicy;

package/dist/security.js

@@ -65,7 +65,7 @@ export function createAuthorizer(config, sessionStore) {
                 let owner = await ownerOf(requested);
                 if (owner === undefined) {
                     if (requireExisting) {
-                        throw new HttpError(404, "requireExistingSession: session does not exist (resume.session_not_found)");
+                        throw createCodedHttpError(404, "resume.session_not_found", "requireExistingSession: session does not exist (resume.session_not_found)");
                     }
                     if (register) {
                         await register(requested, principal ?? null);
@@ -89,7 +89,7 @@ export function createAuthorizer(config, sessionStore) {
         }
         else {
             if (requireExisting) {
-                throw new HttpError(422, "requireExistingSession requires a sessionId — there is no existing session to resume (resume.session_not_found)");
+                throw createCodedHttpError(422, "request.field_conflict", "requireExistingSession requires a sessionId — there is no existing session to resume");
             }
             sessionId = uuidv7();
             if (register)

package/dist/session-policy-wire.d.ts

@@ -66,10 +66,11 @@ export type ToolNameRuleField = {
  * 「照 #1156 未随本版」);同版新导出的 `rosterToolName` / `ruleNamesOf`(#1194)是**别名归一**(一个名字在名册上落到哪只行的线名 /
  * 一次调用可被规则拼成的名字集),不回答「这个名字会不会让准备阶段拒启」,不能替本函数 ⇒ 本函数照留,等 #1156。
  *
- * 🔴 **为什么不复用 `config.ts` 的 `findUnmatchableToolNames`**(本仓另一只按名字判的单点;读过实现后裁):两只回答的
- * 不是同一个问题。那一只问「部署名单里这条名字会不会**永远匹配不上**活工具」—— 它刻意豁免 `allow`(白名单匹配不上 =
- * fail-closed 且当场可见),并且拒两段 MCP 名 `mcp__srv`(一名两义)与 core 文法编不出的串。本函数问的是「引擎见到这条
- * 会话规则会不会**拒启**」:引擎准备阶段的名审计对 `allow` 桶照样抛(豁免它 = 放过一条砖化路径),对 `mcp__srv` 却
+ * 🔴 **为什么不复用 `config.ts` 的 `unmatchableToolNamesRefusal`**(本仓另一只按名字判的单点;读过实现后裁):两只回答的
+ * 不是同一个问题。那一只问「这张表里这条条目会不会**永远不生效**」(匹配不上活工具,或编不成一条规则)—— 7.115.0 起它对 `allow` 也照判
+ * (修前豁免 `allow`:那时 allow 是白名单,匹配不上 = fail-closed 且当场可见;allow 改成 allow 规则后豁免臂已删),并且拒两段 MCP 名
+ * `mcp__srv`(一名两义)与 core 文法编不出的串。本函数问的是「引擎见到这条会话规则会不会**拒启**」:引擎准备阶段的名审计对会话规则的
+ * `allow` 桶照样抛,对 `mcp__srv` 却
  * **不**抛(会话层自 core 5.55 / 5.56 起把它当整对端覆盖形真命中)。判据只能逐字跟 core 那两臂走,不能借另一只的口径。
  * 两只在「退役名」「无前缀 `__` 名」两臂上同源(都读 core 导出的同两件),#1156 到货的那一批一并换调 core 的导出函数。
  */

package/dist/task-settings.d.ts

@@ -12,9 +12,12 @@
  * idempotent (the same tighten), so no special resume handling is needed (mirrors runtime-governance).
  *
  * 🔒 SECURITY INVARIANTS (SDK settings.ts §3.3):
- *  - permissions are TIGHTEN-ONLY — folded via `tightenTaskSpec` (deny-wins `combinePolicies`); it THROWS on any
- *    override that would LOOSEN a stricter base safety field. The client can only ADD denies/asks/handsReadOnly on
- *    top of the deployment + operator baseline, never widen it.
+ *  - permissions are folded via `tightenTaskSpec` (deny-wins `combinePolicies`); it THROWS on any override that would
+ *    LOOSEN a stricter base safety field. The client can ADD denies/asks/handsReadOnly on top of the deployment +
+ *    operator baseline, never widen it. Its `allow` rules (S-654 (c), 7.115.0) STATE an allow for the tools they name —
+ *    the answer core 7.40.0 wants before it runs an MCP / A2A call nobody stated — and never override a deny or an ask
+ *    from any layer (deny > ask > allow); a miss has no opinion. They release no ask a layer raises itself: on built-in
+ *    tools the engine's own write gate and shell checks still ask (unlike the reference implementation's `permissions.allow`).
  *  - permissionMode(轴B #2 注释保鲜,1.254——[ref]/[ref] 后的真实现):`defaultMode` 收**五**模式
  *    (default | acceptEdits | plan | bypassPermissions | auto),bypass/auto 被 HONOR 为 gate-shape 选择
  *    ——但深层不变量未变:bypass=「不加 ask 门」,恒不越部署基线(tightenTaskSpec deny-wins,基线 deny/
@@ -224,8 +227,6 @@ export interface ParseTaskSettingsResult {
  *  posture (an uncapped prompt body is a per-turn token-cost hole; cross review). Exported so the HTTP layer
  *  (prepareSpec) can 400 fail-loud on submit with the SAME bound this defensive parse enforces on every path. */
 export declare const MAX_SETTINGS_OUTPUT_STYLE_CHARS = 16384;
-/** Cap on the element count of each permission list (allow/deny/ask) — bounds a pathological rule blast. */
-export declare const MAX_SETTINGS_PERMISSION_RULES = 1000;
 /** Caps on `settings.env` — bound a pathological env blast (count + per-value length; values land in the shell env). */
 export declare const MAX_SETTINGS_ENV_VARS = 256;
 export declare const MAX_SETTINGS_ENV_VALUE_CHARS = 32768;

package/dist/task-settings.js

@@ -1,6 +1,6 @@
-import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createPermissionRulePolicy, parseRuleText, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, ruleToolGrammarOf, } from "@sema-agent/core";
-import { findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
-import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { combinePolicies, createFsWriteGatePolicy, parseRuleText, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, ruleToolGrammarOf, } from "@sema-agent/core";
+import { unmatchableToolNamesRefusal } from "./config.js";
+import { MAX_PERMISSION_RULES_PER_LIST, createRuleListPolicy } from "./permission-rule-list.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 import { heldRuleName } from "./tool-rule-names.js";
@@ -61,7 +61,6 @@ export function skillListingMaxDescOk(v) {
     return typeof v === "number" && Number.isSafeInteger(v) && v > 0;
 }
 export const MAX_SETTINGS_OUTPUT_STYLE_CHARS = 16_384;
-export const MAX_SETTINGS_PERMISSION_RULES = 1_000;
 export const MAX_SETTINGS_ENV_VARS = 256;
 export const MAX_SETTINGS_ENV_VALUE_CHARS = 32_768;
 export const MAX_SETTINGS_ENV_KEY_CHARS = 256;
@@ -106,8 +105,8 @@ export function settingsPermissionBucketIssue(perms) {
         let fields;
         if (!Array.isArray(v))
             fields = { field, reason: "bad_entry" };
-        else if (v.length > MAX_SETTINGS_PERMISSION_RULES)
-            fields = { field, reason: "over_cap", count: v.length, cap: MAX_SETTINGS_PERMISSION_RULES };
+        else if (v.length > MAX_PERMISSION_RULES_PER_LIST)
+            fields = { field, reason: "over_cap", count: v.length, cap: MAX_PERMISSION_RULES_PER_LIST };
         else {
             const index = v.findIndex((x) => typeof x !== "string" || x.length === 0);
             if (index >= 0)
@@ -266,20 +265,7 @@ export function acceptAppendSystemPrompt(v, warn, packDropsAppend) {
     }
     return v;
 }
-const RULE_SOURCE_BY_BEHAVIOR = { ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
-function createRuleListPolicy(names, behavior, pathBases) {
-    try {
-        return createPermissionRulePolicy(names.map((name) => ({ rule: name, behavior, source: RULE_SOURCE_BY_BEHAVIOR[behavior] })), {
-            defaultAction: "allow",
-            caps: { maxRules: MAX_SETTINGS_PERMISSION_RULES },
-            ...(pathBases !== undefined ? { pathBases } : {}),
-        });
-    }
-    catch (e) {
-        const coreMsg = (e instanceof Error ? e.message : String(e)).replace(CONTROL_AND_BIDI_STRIP_RE, "");
-        throw new Error(`${RULE_SOURCE_BY_BEHAVIOR[behavior].replace("settings.", "")} has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
-    }
-}
+const RULE_SOURCE_BY_BEHAVIOR = { allow: "settings.permissions.allow", ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
 const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];
 const isWorkflowName = (name) => name === RUN_WORKFLOW_TOOL_NAME;
 function createWorkflowAskPolicy(isExempt) {
@@ -327,16 +313,16 @@ function rejectUnmatchableSettingsNames(perms, pathBases) {
             }
         }
     }
-    for (const [field, names, behavior, consumer] of [
-        ["permissions.ask", perms.ask, "ask", "rule-policy"],
-        ["permissions.deny", perms.deny, "deny", "rule-policy"],
-        ["permissions.allow", perms.allow, "allow", "tool-name-table"],
+    for (const [field, names, behavior] of [
+        ["permissions.ask", perms.ask, "ask"],
+        ["permissions.deny", perms.deny, "deny"],
+        ["permissions.allow", perms.allow, "allow"],
     ]) {
         if (!names)
             continue;
-        const bad = findUnmatchableToolNames(names, { consumer, behavior, ...(pathBases !== undefined ? { pathBases } : {}) });
-        if (bad.length > 0)
-            throw new Error(formatUnmatchableToolNames(field, bad));
+        const unmatchable = unmatchableToolNamesRefusal(field, names, { consumer: "rule-policy", behavior, ...(pathBases !== undefined ? { pathBases } : {}) });
+        if (unmatchable !== undefined)
+            throw new Error(unmatchable.message);
     }
 }
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
@@ -350,11 +336,11 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
     rejectUnmatchableSettingsNames(perms, pathBases);
     const policies = [];
     if (allow)
-        policies.push(createAllowDenyPolicy({ allow }));
+        policies.push(createRuleListPolicy(allow, "allow", RULE_SOURCE_BY_BEHAVIOR.allow, pathBases));
     if (deny)
-        policies.push(createRuleListPolicy(deny, "deny", pathBases));
+        policies.push(createRuleListPolicy(deny, "deny", RULE_SOURCE_BY_BEHAVIOR.deny, pathBases));
     if (ask)
-        policies.push(createRuleListPolicy(ask, "ask", pathBases));
+        policies.push(createRuleListPolicy(ask, "ask", RULE_SOURCE_BY_BEHAVIOR.ask, pathBases));
     const fsWriteGate = (acceptCwd) => {
         if (!gate)
             return undefined;

package/dist/tool-approval.d.ts

@@ -452,10 +452,7 @@ export interface ToolApprovalFrame {
      * 耐久路的对偶 = `gate.riskDescriptor.probeCause`(同值,core `buildRiskDescriptor` 铸),走 checkpoint
      * 行的**整体透传**到 `GET /v1/approvals` —— 键集零施工,钉在同一个文件的 §4。
      *
-     * 姊妹键 `AskRequest.probeReason`(同一件事的**散文**兄弟)**今天不投影**:它与本键是同一个事实的两种
-     * 拼法,而 core 的边界哲学(交 code + 数组、不交句子)与「一张卡上不放两份同义解释」都指向只投结构化
-     * 那一份;散文那份还无法被消费端本地化。照 `preview` / `requiresRealApproval` 先例 = 候消费端(cli)
-     * 提渲染需求再翻(登记在 `trace/core-keyset-guard.ts` 的 EXCLUDED 栏)。
+     * 姊妹键 `probeReason`(同一件事的**散文**兄弟)见下一键 —— 7.115.0 起投影(S-733),与本键**并列不替代**。
      */
     probeCause?: {
         code: string;
@@ -468,6 +465,21 @@ export interface ToolApprovalFrame {
             total: number;
         };
     };
+    /**
+     * S-733(7.115.0;**ADDITIVE**,`"tool_approval"` only)—— 这次 ask 被收紧时探针给出的那一句**散文**因由
+     * (`AskRequest.probeReason`:core 在 maybe 档收紧点 `inlineUntrusted(…, 200)` 过的一句话)。与
+     * {@link probeCause}(结构化因由)**并列、不替代**:引擎自己铸的因由走结构位,**部署自写的探针**只会写这一句
+     * —— 一只只给 reason 不给 cause 的探针,此前其审批人在活卡上读不到任何因由(耐久面
+     * `gate.riskDescriptor.probeReason` 早就带着这同一句,两张脸只有一张有话说)。
+     *
+     * 🔴 **在场才带**(缺席绝不编空串;缺席 ≠「没有原因」);窄读单点 = `approval-card.ts` 的 `readProbeReason`
+     * (非串 / 空白 ⇒ 缺席;超信封 ⇒ **整只丢不截**;内容族 ⇒ 脱敏,与耐久面同一规则 ⇒ 对同一句话两面同值)。
+     * 🔴 **只在本帧上**:呈卡帧 / `card_json` 不携它(`ApprovalCardSchema` 是 `.strict()` 的耐久信封,加键要另行裁定)。
+     * 🔴 **展示 / 分诊元数据,永不是裁决输入**;永不进 `message`(那是分类器 / 模型的输入面)。
+     * `\p{Cf}` 展示重排类字符(方向 / 零宽标记):core 在这个座上**不剥**(同值契约下 core 自己披露的残余,[ref]);本仓脱敏器
+     * (`redactSecrets`)入口剥全部 `\p{Cf}`(7.70.0 起),活卡帧与耐久面**都过它** ⇒ 两面同值、且都是剥后字节(`test/approval-probe-reason-wire.test.ts` 钉)。
+     */
+    probeReason?: string;
     /**
      * [ref] 件 G2(core 5.35.0 [ref] G-2;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 背后的
      * **规则出处证据**(`AskRequest.ruleEvidence`,引擎在 gate 内盖章):org 快照 `orgRevision` / 命中的

package/dist/tool-approval.js

@@ -8,7 +8,7 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { MAX_SETTLED_BY_CHARS, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, settledByFitsColumn } from "./plugins/approval-ask-store-sql.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
@@ -1099,6 +1099,7 @@ export class ToolApprovalCoordinator {
             ...((f) => (f !== undefined ? { denialLimitFallback: f } : {}))(readDenialLimitFallback(req)),
             ...((g) => (g !== undefined ? { readRootCandidate: g } : {}))(readReadRootCandidate(req)),
             ...((c) => (c !== undefined ? { probeCause: c } : {}))(readProbeCause(req)),
+            ...((r) => (r !== undefined ? { probeReason: r } : {}))(readProbeReason(req)),
             ...((c) => (c !== undefined ? { ruleEvidence: c } : {}))(readRuleEvidence(req)),
             ...(bounded.omitted ? { argsOmitted: true } : { args: bounded.args }),
             ...(bounded.hasBidi || req.hasBidiControls === true ? { inputHasBidi: true } : {}),

package/dist/trace/core-keyset-guard.d.ts

@@ -43,8 +43,8 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes";
-type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes";
+type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
 type AskFrameServerMinted = "type" | "approvalId" | "argsOmitted" | "outcome" | "governanceForced" | "expiresAtMs" | "expiresInMs" | "serverNowMs" | "parked" | "inputHasBidi";
@@ -88,10 +88,13 @@ type _GuardWiringSessionReverse = AssertAllKeysHandled<Exclude<WiringSessionHand
 type WiringToolsHandled = "schemaVersion" | "count" | "entries" | "digest";
 type _GuardWiringTools = AssertAllKeysHandled<Exclude<keyof WiringSection<"tools">, WiringToolsHandled>>;
 type _GuardWiringToolsReverse = AssertAllKeysHandled<Exclude<WiringToolsHandled, keyof WiringSection<"tools">>>;
-type FleetExcluded = "subagentTranscripts";
-type WiringFleetHandled = "backgroundAgentStore" | "hostChildEventSink" | FleetExcluded;
+type WiringFleetHandled = "backgroundAgentStore" | "hostChildEventSink" | "subagentTranscripts";
 type _GuardWiringFleet = AssertAllKeysHandled<Exclude<keyof WiringSection<"fleet">, WiringFleetHandled>>;
 type _GuardWiringFleetReverse = AssertAllKeysHandled<Exclude<WiringFleetHandled, keyof WiringSection<"fleet">>>;
+type SubagentTranscriptTier = WiringSection<"fleet">["subagentTranscripts"];
+type SubagentTranscriptTierWords = "none" | "rows" | "full";
+type _GuardSubagentTranscriptTierWords = AssertAllKeysHandled<Exclude<SubagentTranscriptTier, SubagentTranscriptTierWords>>;
+type _GuardSubagentTranscriptTierWordsReverse = AssertAllKeysHandled<Exclude<SubagentTranscriptTierWords, SubagentTranscriptTier>>;
 type WiringMcpEntry = WiringSection<"mcp">[number];
 type WiringMcpExcluded = "error";
 type WiringMcpHandled = "name" | "source" | "status" | "errorCode" | "delivered" | "httpStatus" | "toolCount" | "liveness" | WiringMcpExcluded;
@@ -288,6 +291,8 @@ export type CoreKeysetGuards = [
     _GuardWiringToolsReverse,
     _GuardWiringFleet,
     _GuardWiringFleetReverse,
+    _GuardSubagentTranscriptTierWords,
+    _GuardSubagentTranscriptTierWordsReverse,
     _GuardWiringMcp,
     _GuardWiringMcpReverse,
     _GuardWiringRules,

package/dist/trace/project.js

@@ -499,9 +499,18 @@ export function wiringManifestEventData(ev, instructions) {
         ...(Array.isArray(parkIn.reasons) ? { reasons: parkIn.reasons.filter((r) => typeof r === "string") } : {}),
         ...(str(parkIn.checkpointDurability) !== undefined ? { checkpointDurability: parkIn.checkpointDurability } : {}),
     });
+    const subagentTranscripts = (() => {
+        if (fleetIn.subagentTranscripts === undefined)
+            return undefined;
+        const word = str(fleetIn.subagentTranscripts);
+        if (word === undefined)
+            return dropProjectedFace("wiring_manifest.fleet.subagentTranscripts is not a non-empty string");
+        return word;
+    })();
     const fleet = nonEmpty({
         ...(bool(fleetIn.backgroundAgentStore) !== undefined ? { backgroundAgentStore: fleetIn.backgroundAgentStore } : {}),
         ...(bool(fleetIn.hostChildEventSink) !== undefined ? { hostChildEventSink: fleetIn.hostChildEventSink } : {}),
+        ...(subagentTranscripts !== undefined ? { subagentTranscripts } : {}),
     });
     const permissionRules = nonEmpty({
         ...(bool(rulesIn.storeWired) !== undefined ? { storeWired: rulesIn.storeWired } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.114.0",
+  "version": "7.115.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -28,7 +28,7 @@
     "!dist/run-local-linux-x64",
     "!dist/run-local-darwin-arm64",
     "skills",
-    "scripts/retired-mode-seed-drain-local.mjs",
+    "scripts/drain-check-local.mjs",
     "deploy/sema-up",
     "docs/DEVICE-EXECUTOR-PROTOCOL.md",
     "USAGE.md",
@@ -62,8 +62,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.39.2",
-    "@sema-agent/settings-schema": "7.0.1",
+    "@sema-agent/core": "7.40.1",
+    "@sema-agent/settings-schema": "8.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",