@sema-agent/server 7.114.0 → 7.116.0

package/dist/permission-rule-list.d.ts

@@ -0,0 +1,81 @@
+/**
+ * **规则表的唯一编译口** —— 一张工具名规则表(`allow` / `ask` / `deny` 之一)编成一只 `ToolPolicy`。
+ *
+ * 两类读者,同一只编译口(编译与校验各只有一份,不在别处另写第二份文法):
+ *  · 请求腿的 `settings.permissions.{allow,ask,deny}` 三桶(`task-settings.ts` 的 `deriveSettingsPolicy`);
+ *  · 运维的 allow 规则 `APPROVAL_GRANT`(`runtime-governance.ts` 的 `applyRuntimeGovernance`,经部署治理链的单一构造口
+ *    `deployment-governance.ts` 交进来 —— HTTP 提交 / durable 续跑 / 停驻后台 agent 的跨副本赎回 / run-local 四条腿同装)。
+ *
+ * 为什么住在一只叶模块里(不留在 `task-settings.ts`):运维那一侧的启动校验在 `config.ts` 里跑(坏值 = 拒启),而
+ * `task-settings.ts` 值引 `config.ts` —— 编译口留在那里,`config.ts` 要调它就闭合一只 ESM 装载环。本模块只 import core 与
+ * `text-bidi.ts`(纯叶),三处读者引它都不成环。
+ */
+import { type PathRuleBases, type RuleBehavior, type ToolPolicy } from "@sema-agent/core";
+/** 一张表里规则条数的上限 —— 请求腿 wire 门(`task-settings.ts` 的三桶判形)读的也是这一个名字:core 的缺省帽是 256,
+ *  不对齐的话第 257 条起编译当场抛,等于服务端自己收下的东西自己反悔。 */
+export declare const MAX_PERMISSION_RULES_PER_LIST = 1000;
+/** A name-keyed rule-list ToolPolicy: a tool named by `names` gets `behavior` (an `allow` hit states the allow with
+ *  `decisionReason: "rule"`; `ask` tightens to an approval gate; `deny` hard-blocks); every other tool is out of
+ *  scope (`defaultAction: "allow"` = this policy has no opinion about anything it does not name). Composed deny-wins
+ *  with the rest of the fold, so `ask` / `deny` only ever tighten and an `allow` never overrides a deny or an ask.
+ *
+ *  `source` = 这张表**写在哪**(请求腿 `settings.permissions.<桶>`;运维腿 `APPROVAL_GRANT`)。它盖进每条规则(core 的 deny / ask
+ *  句里点名它:`flagged by permission rule "mcp__figma__*" (settings.permissions.ask)`),编不出来时的错误句也点名它;只是出处,
+ *  不带任何优先级(层序在各自的折叠里)。
+ *
+ * 🔴 [ref] / core [ref] —— 本函数曾是 `new Set(askNames).has(req.toolName)` 的**逐字**比对,那是
+ *  **安全轴上的静默 fail-open**:CC 自家 settings validator 推荐的 covering 拼法
+ *  (`"MCP rules do not support patterns in parentheses … use mcp__srv__*"`)在逐字比对下永远配不上真工具名
+ *  `mcp__figma__get_file` ⇒ 一次不问、直跑、审计静音。两道兜底也各自放行:`unmatchableToolNamesRefusal`
+ *  对 `mcp__<peer>__*` 判「合法 MCP 全名」(server 不持挂载表,动态宇宙不能按名单否定),`nameSets` 审计面
+ *  报的是「没匹配上的名字」而 covering 名在 core 眼里**是**匹配得上的。同一份 settings 里
+ *  `deny:["mcp__figma__*"]` 却**真拦** —— deny 走 `createAllowDenyPolicy`,它用的是 core 的
+ *  `namespacedCoveringEntries/Hit`。同族分家,差的只是解析器。
+ *
+ *  ⇒ **规则表的 policy 面现在同源**:三种态度都由 `createPermissionRulePolicy` 的 covering 车道解,底下是
+ *  core 的**同一只** `namespacedRuleNameCovers`(协议无关:`mcp__`/`a2a__` 同解;peer 段精确比;工具段 `*`/glob 覆盖)。
+ *  本仓**不自写第二套 glob** —— 那正是当年分家的成因。
+ *
+ *  ⚠️ 「同源」的**射程**说准了免得下一个人当成全仓结论(codex 交叉轮 finding-1 追出来的边):
+ *   · 同源的是**本编译口**认的 covering。表**进门前**还有一道更外层的判据(`config.ts` 的 `unmatchableToolNamesRefusal`,
+ *     请求腿经 `task-settings.ts` 的 `rejectUnmatchableSettingsNames`、运维腿经 `config.ts` 的 `approvalGrantRefusal`),它把
+ *     `<ns>__<peer>` **两段形**(`mcp__figma`)判成「缺段名」拒掉 —— 而 core 三只 policy 都认这个形(实测:
+ *     `createAllowDenyPolicy`/`createPermissionRulePolicy`/`createApprovalPolicy` 对 `mcp__figma` 一律解成 covering)。
+ *     所以各表收 `mcp__figma__*`(等价、且被推荐)、拒 `mcp__figma`。
+ *   · **同源的射程已扩到 operator 名单腿**([ref] 孪生修,[ref]):`createDurableAskPolicy`(`src/approval.ts`)的
+ *     deny/neverAuto/require 三集合过去是逐字 `Set.has`,自 core 5.60.1 谓词根导出后改成「精确 ∪ covering」,用的是
+ *     **同一只** `namespacedRuleNameCovers`。⇒ env `APPROVAL_*` 腿 / 中心下发 `runtime.approvalRequire` 腿 / 规则表三家
+ *     现在对 covering 拼法的解读逐字一致,`mcp__figma__*` 在哪条腿上都是真判。
+ *   · **两段形为什么仍不放开**(理由已换,别再引「approval.ts 还不认」):它一名两义——「整台服务器」与「三段名写漏一段」
+ *     在 boot 期不可分辨,所以各条腿一律响亮拒 + 指引给无歧义的 `mcp__figma__*`。放宽是各腿同时变宽的 behavior-facing
+ *     改动,走独立批的三问。详见 `unmatchableToolNamesRefusal` 顶注。
+ *
+ *  三处刻意的取舍,都是亲读 core dist 后定的:
+ *   · `onInvalidRule:"throw"`(缺省)—— 一条编不出来的规则整表拒(请求腿 → resolve-spec 翻 422;运维腿 → 拒启),抛之前补上
+ *     出处名(core 的原文只说 "createPermissionRulePolicy: …",不说是哪张表出的错)。[ref] 的括号形在**更外层**已被拒,够不着
+ *     这里;真正新增的是「名字里带反斜杠」「单条 > 512 字符」这两族永不匹配的拼法。
+ *     ✅ **不对称已收口([ref]①,[ref] 销)**:codex finding-2 当年如实登记的「同样两族拼法在 `deny`
+ *     上仍是静默 no-op」已修 —— 判据搬进单点成文的 `unmatchableToolNamesRefusal`,它拿 core 自己的 `validatePermissionRules`
+ *     对同一串跑一遍文法(不自铸第二套判词),于是三张表对这两族说同一句话。S-654 (c) 起 `allow` 也收。
+ *     ⚠️ 存量 resume:带这两族拼法的**已存 body** 在 resume 腿会 422(resolve-spec 翻)。这**不是**新造的姿态——A3
+ *     (`rejectUnmatchableSettingsNames`)早就对存量 body 里的退役名/短名同样抛,且 `applyTaskSettings` 腿有专门的回归钉。
+ *     判据同一条:一个**静默不存在的审批门**比一次响亮失败更贵。codex 建议的「给非法存量条目保留旧的逐字比对」被**驳回**:
+ *     那正是把 fail-open 请回来。
+ *   · `caps.maxRules` 对齐 {@link MAX_PERMISSION_RULES_PER_LIST}(理由见那只常量)。core 的 set-level cap 连 `skip` 都照抛,
+ *     所以运维腿的启动校验还要**试编一次**(`approvalGrantRefusal`)才拦得住超帽 —— 判据仍是本函数这一只。
+ *   · 不再自铸 `decisionReason:"rule"` —— core 的规则策略本就不铸这个键(allow 命中由 core 自己铸 `"rule"`),且 core 侧唯一区分它的
+ *     两处(prepare-task 的继承 grant 复用判据、park 的 rule-suggestion 门)对 `"rule"` 与 `undefined` **同待**(只把 `"hook"`
+ *     排除在外),dist 亲读在案。审计归因改由 `matchedAskRule` + `source` 承担,后者比前者强:它还让 core 的 auto-mode 分类器
+ *     **拒绝**替人清掉这条 ask(「运维写下的『每次问我』不是分类器的犹豫」),方向是收紧。
+ *
+ * 🔴 **S-654 (c)(7.115.0,core 7.40.0 #1065):三种态度同一个编译口,`allow` 也走这里** —— `behavior: "allow"` 的规则命中 = core 带
+ *  `decisionReason: "rule"` 的放行 —— allow 规则给出「有人表态」—— 它回答的是没人表态的服务器工具 / A2A 技能调用;内置工具上引擎自己的写门、shell 检查照问,deny / ask 照赢(与参照实现的 `permissions.allow` 在内置工具上**不同**:那边 `allow: ["Edit"]` 跳过编辑确认,这里不放掉引擎的写门);未命中 = `defaultAction: "allow"` 的裸 allow
+ *  = 不表态、照常判。修前请求腿的 allow 编成 `createAllowDenyPolicy({ allow })` 的**名单**(名单在场 ⇒ 名单外的工具一律拒),与写它的人要的
+ *  「替这些工具表态」方向相反;终端因此从不投这只桶。core 7.40.0 起没人表态的服务器工具调用要问,allow 规则就是那张卡的常设答案
+ *  (`mcp__<server>__*` 一条覆盖整台服务器)。allow 规则**不越过** deny / ask:折叠 deny > ask > allow,任何一层的 deny / ask 照赢;
+ *  它只在没人反对时给出那句表态。core 的 allow 文法只收工具名形(精确名 / `mcp__`·`a2a__` covering 形),内容形放行(`Bash(npm:*)` /
+ *  `Edit(src/**)` / 参数级)core 拒编,两条腿与 deny / ask 同一个出口(判据 `unmatchableToolNamesRefusal`)。
+ *  7.115.0 起运维的 `APPROVAL_GRANT` 也编在这里(无人值守腿没有请求体,那是运维为自己接的服务器表态的唯一位置)。 */
+/** `behavior` = 这张表的态度 —— 型直接是 core 的 `RuleBehavior`(不手抄:core 加一种态度,这里与它同步、读者 tsc 上见到)。 */
+export declare function createRuleListPolicy(names: readonly string[], behavior: RuleBehavior, source: string, pathBases: PathRuleBases | undefined): ToolPolicy;
+//# sourceMappingURL=permission-rule-list.d.ts.map

package/dist/permission-rule-list.js

@@ -0,0 +1,17 @@
+import { createPermissionRulePolicy } from "@sema-agent/core";
+import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+export const MAX_PERMISSION_RULES_PER_LIST = 1_000;
+export function createRuleListPolicy(names, behavior, source, pathBases) {
+    try {
+        return createPermissionRulePolicy(names.map((name) => ({ rule: name, behavior, source })), {
+            defaultAction: "allow",
+            caps: { maxRules: MAX_PERMISSION_RULES_PER_LIST },
+            ...(pathBases !== undefined ? { pathBases } : {}),
+        });
+    }
+    catch (e) {
+        const coreMsg = (e instanceof Error ? e.message : String(e)).replace(CONTROL_AND_BIDI_STRIP_RE, "");
+        throw new Error(`${source.replace("settings.", "")} has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
+    }
+}
+//# sourceMappingURL=permission-rule-list.js.map

package/dist/plugins/file-run-store.d.ts

@@ -182,7 +182,7 @@ export declare class FileRunStore {
     /** Release any claim whose row is now terminal; KEEP suspended/needs_review (resume re-finds them). One place for
      *  the claim-release invariant, shared by reapRunning + reclaimOrphanedAtBoot. */
     private sweepClaims;
-    /** Flip every `running` row matching `pred` → failed (with `reason`), then sweep terminal claims. */
+    /** Flip every `running` row matching `pred` → failed (with the death sentence `reason` + its machine `code`), then sweep terminal claims. */
     private reapRunning;
     reapStale(olderThanMs: number): Promise<number>;
     /** TOC integration ask③ (INTEGRATION-DESIGN §11): a host-lane engine restart leaves the PREVIOUS process's
@@ -320,6 +320,12 @@ export declare class FileRunStore {
      * @returns 被改写的账本**行**数(不是 run 数)。
      */
     migrateRetiredAskOriginRows(): Promise<number>;
+    /**
+     * 一次性迁移 **M6 的 local 腿**(窗、删法与删后谁接住:窗口见 `plugins/one-time-migrations.ts` 登记表):把 ≤7.115.x 写下的死亡判决行
+     * (`failed` ∧ 码列空 ∧ 句子是那两句,判据 = `readLegacyHolderDeathCode`)补上机读码,盘上(`run.json` 整份原子替换,同 `persist`)与内存同改。
+     * 起服时调(`LocalBackend.runOneTimeMigrations`,任何读者之前);数据根独占 ⇒ 本车道没有滚动升级窗,不需要读侧半场。幂等:第二跑零命中零写盘。
+     */
+    migrateLegacyHolderDeathCodes(): number;
     /** Release every open event-log fd (called by LocalBackend.close so a graceful restart can re-open the data dir). */
     dispose(): void;
 }

package/dist/plugins/file-run-store.js

@@ -7,7 +7,7 @@ import { randomBytes } from "node:crypto";
 import { AppendLog, atomicWriteFile, ensureDir, isProcessLive, processFingerprint, sanitizePathComponent, writeThenLink } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
-import { RUN_ORPHANED_ERROR, RUN_STALLED_ERROR, StoreBootRefusalError, buildRunOrphanedError } from "./store-contracts.js";
+import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR, StoreBootRefusalError, buildRunOrphanedError, readLegacyHolderDeathCode } from "./store-contracts.js";
 import { notifyRunTerminal } from "../observability/run-terminal.js";
 import { migrateRetiredAskOrigin } from "./one-time-migrations.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
@@ -573,13 +573,14 @@ export class FileRunStore {
                 this.releaseClaim(sessionId);
         }
     }
-    reapRunning(pred, reason) {
+    reapRunning(pred, reason, code) {
         let reaped = 0;
         for (const r of this.runs.values()) {
             if (r.status === "running" && pred(r)) {
                 r.status = "failed";
                 r.result = null;
                 r.error = reason;
+                r.errorCode = code;
                 r.updatedAt = new Date();
                 this.persist(r);
                 reaped += 1;
@@ -590,7 +591,7 @@ export class FileRunStore {
     }
     async reapStale(olderThanMs) {
         const cutoff = Date.now() - olderThanMs;
-        return this.reapRunning((r) => r.updatedAt.getTime() < cutoff, RUN_STALLED_ERROR);
+        return this.reapRunning((r) => r.updatedAt.getTime() < cutoff, RUN_STALLED_ERROR, RUN_HOLDER_DEATH_CODES.stalled);
     }
     async reclaimOrphanedAtBoot(isResumable) {
         const orphans = [];
@@ -602,6 +603,7 @@ export class FileRunStore {
             r.status = "failed";
             r.result = null;
             r.error = RUN_ORPHANED_ERROR;
+            r.errorCode = RUN_HOLDER_DEATH_CODES.orphaned;
             r.updatedAt = new Date();
             this.persist(r);
         }
@@ -730,7 +732,7 @@ export class FileRunStore {
                 const verdict = await this.judgeClaim(sessionId, claim, holder);
                 if (verdict.kind === "live")
                     return { ok: false, activeTaskId: verdict.holderTaskId ?? holder };
-                this.takeOverClaim(sessionId, verdict.reason, verdict.snapshot);
+                this.takeOverClaim(sessionId, verdict.reason, verdict.snapshot, verdict.code);
             }
         }
         try {
@@ -806,9 +808,9 @@ export class FileRunStore {
             pidStillRunning: owner !== undefined && isProcessLive({ pid: owner.pid }),
             note: "the claim's owner process is provably not the one that wrote it (fingerprint falsified, or the pid is gone) and the row has nothing left to resume — taking the claim over",
         });
-        return { kind: "stale", reason: buildRunOrphanedError(who), snapshot };
+        return { kind: "stale", reason: buildRunOrphanedError(who), snapshot, code: RUN_HOLDER_DEATH_CODES.orphaned };
     }
-    takeOverClaim(sessionId, reason, snapshot) {
+    takeOverClaim(sessionId, reason, snapshot, code) {
         const nowClaim = readClaimRecord(singleRecordOf(this.readRecords(this.activePath(sessionId), CLAIM_RECORD_SHAPE)), sessionId);
         if (snapshot.torn) {
             if (nowClaim !== undefined)
@@ -820,7 +822,7 @@ export class FileRunStore {
         if (row?.status !== snapshot.status || row?.updatedAt.getTime() !== snapshot.updatedAtMs)
             return false;
         if (row && (row.status === "running" || row.status === "suspended" || row.status === "needs_review")) {
-            this.persist({ ...row, status: "failed", error: reason, updatedAt: new Date() });
+            this.persist({ ...row, status: "failed", error: reason, ...(code !== undefined ? { errorCode: code } : {}), updatedAt: new Date() });
         }
         const quarantine = join(this.tmpDir, `stale-claim.${sanitizePathComponent(sessionId)}.${process.pid}.${randomBytes(6).toString("hex")}`);
         try {
@@ -899,6 +901,17 @@ export class FileRunStore {
         }
         return migrated;
     }
+    migrateLegacyHolderDeathCodes() {
+        let migrated = 0;
+        for (const r of this.runs.values()) {
+            const code = readLegacyHolderDeathCode(r);
+            if (code === null || r.errorCode === code)
+                continue;
+            this.persist({ ...r, errorCode: code });
+            migrated += 1;
+        }
+        return migrated;
+    }
     dispose() {
         for (const log of this.eventLogs.values()) {
             try {

package/dist/plugins/memory-run-store.js

@@ -1,7 +1,7 @@
 import { redactErrorMessage, redactLedgerEventData, sealRunRowResult } from "../observability/run-terminal.js";
 import { outwardPlane } from "../terminal.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
-import { RUN_STALLED_ERROR } from "./store-contracts.js";
+import { RUN_HOLDER_DEATH_CODES, RUN_STALLED_ERROR } from "./store-contracts.js";
 import { notifyRunTerminal } from "../observability/run-terminal.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 export class MemoryRunStore {
@@ -300,6 +300,7 @@ export class MemoryRunStore {
                 r.status = "failed";
                 r.result = null;
                 r.error = RUN_STALLED_ERROR;
+                r.errorCode = RUN_HOLDER_DEATH_CODES.stalled;
                 r.updatedAt = new Date();
                 reaped += 1;
             }

package/dist/plugins/one-time-migrations.d.ts

@@ -22,6 +22,8 @@ export interface OneTimeMigrationReport {
     readonly sessionIncarnationColumn: "added" | "present" | "no-table" | "lazy-on-read";
     /** M5:本次给空化身铸了令牌的行数。非零 = 这次迁移真写了存量行,必须让运维看见(与 M4 同一条纪律)。 */
     readonly sessionIncarnationsBackfilled: number;
+    /** M6:本次给「只有句子」的死亡判决行补上机读码的 run 行数(SQL `task_run` / local `run.json`)。非零 = 这次迁移真写了存量行(与 M4 同一条纪律)。 */
+    readonly holderDeathCodeRowsBackfilled: number;
 }
 /**
  * S-590 —— 一条一次性迁移的窗(登记表的一行;纯数据)。字段注写着每个值的取证方式,改一行之前照着重核。
@@ -54,8 +56,8 @@ export interface OneTimeMigrationWindow {
  * 而留着 M3 会让 M3 永远判「跑过了」。三条同版引入、同一天到期,本来就同一次删。
  */
 export declare const ONE_TIME_MIGRATIONS: readonly OneTimeMigrationWindow[];
-/** local 车道上 SQL 独有的四条(M1 / M2 / M4 / M5)的读数:那几张表 / 列在文件底座上从来不存在 ⇒ 如实答 absent / 0。 */
-export declare const NO_SQL_MIGRATIONS: Omit<OneTimeMigrationReport, "askOriginRowsMigrated">;
+/** local 车道上 SQL 独有的四条(M1 / M2 / M4 / M5)的读数(M3 / M6 两车道都有,local 腿的读数由 `LocalBackend.runOneTimeMigrations` 现算):那几张表 / 列在文件底座上从来不存在 ⇒ 如实答 absent / 0。 */
+export declare const NO_SQL_MIGRATIONS: Omit<OneTimeMigrationReport, "askOriginRowsMigrated" | "holderDeathCodeRowsBackfilled">;
 /** 启动期的日志口(logger 的子集)。两级各有其用,见 {@link logOneTimeMigrations}。 */
 export interface MigrationLogSink {
     warn(msg: string, meta?: Record<string, unknown>): void;

package/dist/plugins/one-time-migrations.js

@@ -2,6 +2,7 @@ import { acquireEnsureSchemaLock, releaseEnsureSchemaLock } from "./tidb-pool.js
 import { acquirePgEnsureSchemaLock, releasePgEnsureSchemaLock } from "./pg-pool.js";
 import { jsonColumnTextExpr } from "./sql-json-column.js";
 import { SESSION_META_INCARNATION_COLUMN, mintSessionIncarnation } from "../session-incarnation.js";
+import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR } from "./store-contracts.js";
 export const ONE_TIME_MIGRATIONS = [
     {
         id: "M1",
@@ -62,6 +63,19 @@ export const ONE_TIME_MIGRATIONS = [
             "`session.incarnation_missing`(parked 决定腿因此拒、记忆座退回按 id 绑定并 warn)—— 运维手工给那些行填一只随机令牌即可",
         reportKeys: ["sessionIncarnationColumn", "sessionIncarnationsBackfilled"],
     },
+    {
+        id: "M6",
+        introducedIn: "7.116.0",
+        releasedOn: "2026-10-05",
+        removableAfter: "2026-11-04",
+        removal: "删 migrateOn 的 M6 步(`task_run` 两条 `UPDATE … SET error_code`)与 local 腿 `FileRunStore.migrateLegacyHolderDeathCodes`(及 " +
+            "`LocalBackend.runOneTimeMigrations` 里那一格);报告与日志行的 `holderDeathCodeRowsBackfilled`;**连同读侧半场一起删**:" +
+            "`store-contracts.ts` 的 `readLegacyHolderDeathCode` 与 SQL 行映射 `run-store-sql.ts#rowToRun` 里对它的调用(码列改回原样读)",
+        afterRemoval: "没有响亮臂:窗关删码之后仍只有句子、码列为空的行(跳过了所有带 M6 的版本直接升的库,或窗关之后还在写的 ≤7.115.x 副本)不再被判成持有者死亡 —— " +
+            "用户输入受理账本的收敛判词(`user-input-ledger.ts` `judgeOpen`)对这种行落到「其余」臂 `leg_over`:补落 `settled{leg_end}`、不告知,那条 run 上" +
+            "丢掉的 steer 不再告诉用户;`GET /v1/runs/:id` 上 `errorCode` 缺席、只剩 `error` 句子",
+        reportKeys: ["holderDeathCodeRowsBackfilled"],
+    },
 ];
 export const NO_SQL_MIGRATIONS = {
     retiredSnapshotTable: "absent",
@@ -204,6 +218,12 @@ async function migrateOn(db, dialect) {
         : await db.exec(`UPDATE ${AUDIT_TABLE} SET ${AUDIT_DETAIL_COLUMN} = NULL ` +
             `WHERE ${AUDIT_DETAIL_COLUMN} IS NOT NULL AND ${jsonColumnTextExpr(dialect, AUDIT_DETAIL_COLUMN)} = 'null'`);
     const { sessionIncarnationColumn, sessionIncarnationsBackfilled } = await migrateSessionIncarnations(db, dialect);
+    const holderDeathCodeRowsBackfilled = (await db.exec(dialect === "tidb"
+        ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND error = ?"
+        : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND error = $2", [RUN_HOLDER_DEATH_CODES.stalled, RUN_STALLED_ERROR])) +
+        (await db.exec(dialect === "tidb"
+            ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND (error = ? OR error LIKE ?)"
+            : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND (error = $2 OR error LIKE $3)", [RUN_HOLDER_DEATH_CODES.orphaned, RUN_ORPHANED_ERROR, `${RUN_ORPHANED_ERROR} (%`]));
     let retiredSnapshotTable = "absent";
     let retiredSnapshotRows = 0;
     let retiredSteerSeatColumn = "absent";
@@ -236,7 +256,7 @@ async function migrateOn(db, dialect) {
     }
     return {
         retiredSnapshotTable, retiredSnapshotRows, retiredSteerSeatColumn, retiredSteerSeatStaleRows, askOriginRowsMigrated, auditDetailJsonNullRows,
-        sessionIncarnationColumn, sessionIncarnationsBackfilled,
+        sessionIncarnationColumn, sessionIncarnationsBackfilled, holderDeathCodeRowsBackfilled,
     };
 }
 const INCARNATION_BACKFILL_BATCH = 500;
@@ -309,7 +329,7 @@ export function migrateRetiredAskOrigin(type, data) {
 }
 export function logOneTimeMigrations(log, backend, report) {
     const changed = report.retiredSnapshotTable === "dropped" || report.retiredSteerSeatColumn === "dropped" || report.askOriginRowsMigrated > 0 || report.auditDetailJsonNullRows > 0 ||
-        report.sessionIncarnationColumn === "added" || report.sessionIncarnationsBackfilled > 0;
+        report.sessionIncarnationColumn === "added" || report.sessionIncarnationsBackfilled > 0 || report.holderDeathCodeRowsBackfilled > 0;
     (changed ? log.warn : log.info).call(log, "one_time_migrations_applied", {
         backend,
         retiredSnapshotTable: report.retiredSnapshotTable,
@@ -320,11 +340,14 @@ export function logOneTimeMigrations(log, backend, report) {
         auditDetailJsonNullRows: report.auditDetailJsonNullRows,
         sessionIncarnationColumn: report.sessionIncarnationColumn,
         sessionIncarnationsBackfilled: report.sessionIncarnationsBackfilled,
+        holderDeathCodeRowsBackfilled: report.holderDeathCodeRowsBackfilled,
         removableAfter: Object.fromEntries(ONE_TIME_MIGRATIONS.map((w) => [w.id, w.removableAfter])),
         note: "one-time persisted-data migrations (M1: retired whole-tree snapshot index table dropped; M2: retired single-seat " +
             "steering column dropped; M3: retired ask-origin spelling rewritten in place; M4: audit details written as the JSON " +
             "text `null` by an earlier version folded to a SQL NULL, so \"no detail\" has exactly one on-disk spelling; M5: the " +
-            "session incarnation column added and every session row without one minted its own token). Each step " +
+            "session incarnation column added and every session row without one minted its own token; M6: run rows failed by a " +
+            "holder-death verdict written by an earlier version with only the sentence got the machine-readable code run.stalled / " +
+            "run.orphaned). Each step " +
             "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
             "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
             "version that still carries a step at least once before upgrading past its deletion.",

package/dist/plugins/pg-session-storage.js

@@ -317,7 +317,7 @@ export class PgSessionStore {
             return `$${params.length}`;
         };
         const where = ["sm.placement_kind IS NULL"];
-        if (opts.owner)
+        if (opts.owner !== undefined)
             where.push(opts.includeUnowned ? `(sm.owner = ${ph(opts.owner)} OR sm.owner IS NULL)` : `sm.owner = ${ph(opts.owner)}`);
         if (opts.q)
             where.push(`EXISTS (SELECT 1 FROM task_run tr WHERE tr.session_id = sm.session_id AND LOWER(tr.objective_preview) LIKE LOWER(${ph(`%${escapeLike(opts.q)}%`)}) ESCAPE '\\')`);

package/dist/plugins/run-store-sql.js

@@ -6,7 +6,7 @@ import { pgSanitizeText } from "./pg-safe-json.js";
 import { toIso as iso } from "./sql-row-helpers.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, jsonColumnText, readJsonObjectColumn, readNonNullJsonValueColumn } from "./sql-json-column.js";
-import { RUN_STALLED_ERROR } from "./store-contracts.js";
+import { RUN_HOLDER_DEATH_CODES, RUN_STALLED_ERROR, readLegacyHolderDeathCode } from "./store-contracts.js";
 import { notifyRunTerminal, runTerminalLogLevel } from "../observability/run-terminal.js";
 import { mysqlDriver, pgDriver, dialectJsonEncoder } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
@@ -214,7 +214,7 @@ export class SqlRunStore {
             status: r.status,
             result: refusing("serve a finished run as if it had produced nothing", () => decodeResultColumn(r.result, String(r.task_id))) ?? null,
             error: r.error ?? null,
-            errorCode: r.error_code ?? null,
+            errorCode: readLegacyHolderDeathCode({ status: String(r.status), error: r.error ?? null, errorCode: r.error_code ?? null }),
             jobId: r.job_id ?? null,
             source: r.source ?? null,
             instanceId: r.instance_id ?? null,
@@ -424,8 +424,8 @@ export class SqlRunStore {
         const cutoff = new Date(Date.now() - olderThanMs);
         let reaped = 0;
         await this.tx(async (conn) => {
-            const { affected } = await conn.query(this.q(`UPDATE task_run SET status = 'failed', result = NULL, error = '${RUN_STALLED_ERROR}', updated_at = ? ` +
-                "WHERE status = 'running' AND updated_at < ?", `UPDATE task_run SET status = 'failed', result = NULL, error = '${RUN_STALLED_ERROR}', updated_at = $1 ` +
+            const { affected } = await conn.query(this.q(`UPDATE task_run SET status = 'failed', result = NULL, error = '${RUN_STALLED_ERROR}', error_code = '${RUN_HOLDER_DEATH_CODES.stalled}', updated_at = ? ` +
+                "WHERE status = 'running' AND updated_at < ?", `UPDATE task_run SET status = 'failed', result = NULL, error = '${RUN_STALLED_ERROR}', error_code = '${RUN_HOLDER_DEATH_CODES.stalled}', updated_at = $1 ` +
                 "WHERE status = 'running' AND updated_at < $2"), [new Date(), cutoff]);
             reaped = affected;
             await conn.query(this.q("DELETE ta FROM task_active ta JOIN task_run tr ON ta.task_id = tr.task_id WHERE tr.status NOT IN ('running','suspended','needs_review')", "DELETE FROM task_active ta USING task_run tr WHERE ta.task_id = tr.task_id AND tr.status NOT IN ('running','suspended','needs_review')"));

package/dist/plugins/session-policy-store-sql.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
-import { loosenReasons, SessionPolicyError, normalizeRules, stripRev } from "@sema-agent/core";
-import { readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../session-policy-wire.js";
+import { assertSessionRuleNamesCurrent, loosenReasons, SessionPolicyError, normalizeRules, stripRev } from "@sema-agent/core";
+import { assertSessionRuleNamesReachable, readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../session-policy-wire.js";
 import { decodeJsonColumn, isJsonColumnBodyProblem, jsonColumnText } from "./sql-json-column.js";
 import { pgHasUnstorable } from "./pg-safe-json.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
@@ -104,6 +104,8 @@ export class SqlSessionPolicyStore {
                 throw new SessionPolicyError("corrupt", `the session rules rev mark for session ${JSON.stringify(sessionId)} is unreadable (rev ${String(markRows[0].rev)}, gen ${String(markRows[0].gen)}) — refusing rather than stamp a rev/lineage nothing proves`);
             }
             const clean = normalizeRules(stripRev(rules));
+            assertSessionRuleNamesCurrent(clean);
+            assertSessionRuleNamesReachable(clean);
             if (prior && opts?.operator !== true) {
                 const loosens = loosenReasons(prior, clean);
                 if (loosens.length > 0) {

package/dist/plugins/store-backend.d.ts

@@ -1,6 +1,6 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import type { SessionStore, SessionPolicyStore, FileHistoryStore, WorkflowJournalStore, ToolResultStore, SessionCaptureRecordStore } from "@sema-agent/core";
+import type { SessionStore, SessionPolicyStore, FileHistoryStore, WorkflowJournalStore, ToolResultStore, SessionCaptureRecordStore, UsageWindowStore } from "@sema-agent/core";
 import { type OutcomeSink } from "./file-outcome-sink.js";
 import { type InboxWarn } from "./workflow-run-store-sql.js";
 import { FileRunStore } from "./file-run-store.js";
@@ -355,6 +355,11 @@ export interface StoreBackend {
      *  clock to expose replica clock skew (the write-behind counters bucket on LOCAL floor(now/windowMs); skew
      *  splits a fleet window into disjoint buckets = soft-limit leak). OPTIONAL: local backend omits (no fleet). */
     dbNowMs?(): Promise<number>;
+    /** S-1014(core 7.41.0 #1308):**local 后端专有**的 usage-window 账本店 = core `FileStorageBackend` 自己那一只(`usageWindowStore`)——
+     *  它的坏读披露座是 backend 构造时那**一只** `onCorruptRead`(core:「`FileStorageBackend` forwards its one sink」),所以坏账本拒(`usage_window.store_corrupt`,
+     *  拒绝句不带盘上位置)的同时,路径进本 backend 的 `file_store_corrupt_read` 披露座(逐命中 warn)。修前 `boot/stores.ts` 在同一数据根上自己
+     *  `new FileUsageWindowStore(root)` 第二只实例、不接座 ⇒ 坏值只拒不披露,运维找不到是哪只文件。SQL 后端省略(它们有自己的 usage-window 双方言店)。 */
+    fileUsageWindowStore?(): UsageWindowStore;
 }
 /** (c)(clay 拍 a+c,2026-07-27;[ref] 换店后域=file_history_blob,门与旋钮名不变)云形 blob 姿势门——
  *  boot 时调用(boot/stores.ts),纯函数可单测。SQL 后端(mysql|pg)把 blob 字节落单行的形已被两役

package/dist/plugins/store-backend.js

@@ -265,7 +265,7 @@ class LocalBackend {
     }
     async ensureSchema() { }
     async runOneTimeMigrations() {
-        return { ...NO_SQL_MIGRATIONS, askOriginRowsMigrated: await this.runStore.migrateRetiredAskOriginRows() };
+        return { ...NO_SQL_MIGRATIONS, askOriginRowsMigrated: await this.runStore.migrateRetiredAskOriginRows(), holderDeathCodeRowsBackfilled: this.runStore.migrateLegacyHolderDeathCodes() };
     }
     async close() {
         await this.sessionStore.dispose();
@@ -315,6 +315,7 @@ class LocalBackend {
     }
     checkpointStoreInst;
     sessionPolicy() { return this.fileBackend.sessionPolicyStore; }
+    fileUsageWindowStore() { return this.fileBackend.usageWindowStore; }
     fileHistory() { return this.fileBackend.fileHistoryStore; }
     memoryOptOutGrant() { return undefined; }
     sessionCaptureRecords() { return this.captureRecordsSource; }

package/dist/plugins/store-contracts.d.ts

@@ -140,7 +140,7 @@ export type PersistedTaskResult = TaskResult & PersistedResultSideKeys;
 /**
  * 🔴 run 店「持有它的实例丢了」那一判的**行上落款**(S-928 codex r1-F1 提为常量):三只 run 店的 `reapStale` 把心跳过期的 running 行翻成
  * `failed` 并写下这一句。它是 run 店死亡判决留在行上的证据之一(另一只 = {@link RUN_ORPHANED_ERROR})—— 用户输入受理账本的收敛判词
- * (S-969 L8 起两车道同一只)据 {@link isHolderDeathVerdict} 在 reap **之后**仍能判出「写者死了」。改这一句 = 改那条判据;所以三个写者与那一个读者都只引用本常量。读时折叠成同一句话的 wire 展示站点
+ * (S-969 L8 起两车道同一只)据 {@link isHolderDeathVerdict} 在 reap **之后**仍能判出「写者死了」—— 7.116.0 起判据是同行的机读码 `run.stalled`({@link RUN_HOLDER_DEATH_CODES}),本句只给人读;三个写者同写句子与码。读时折叠成同一句话的 wire 展示站点
  * (`routes/runs.ts` 的 stale 折叠、`routes/trace-usage.ts` 的 WORKER_DOWN 帧)刻意留字面量:它们由文案冻结门逐字钉着,且不参与任何判据。
  */
 export declare const RUN_STALLED_ERROR = "run stalled (instance lost?)";
@@ -148,19 +148,38 @@ export declare const RUN_STALLED_ERROR = "run stalled (instance lost?)";
  * 🔴 File 车道「持有它的进程随重启没了」那一判的行上落款(S-969 L8 提为常量):boot 孤儿回收(`FileRunStore.reclaimOrphanedAtBoot`,
  * 数据根 LOCK 作证前世进程已死 ⇒ 仍 running 的行无条件判孤儿)与运行期 claim 接管的 running 臂(`judgeClaim`,外来 + owner 已死 + 无可续)
  * 都写这一句;接管臂在括号里附上前任持有者的进程指纹(取证用,形 = {@link buildRunOrphanedError})。与 {@link RUN_STALLED_ERROR} 同一种身份:
- * run 店写在行上的**死亡判决**,读者 = {@link isHolderDeathVerdict}。
+ * run 店写在行上的**死亡判决**,读者 = {@link isHolderDeathVerdict}(按同行的机读码 `run.orphaned` 判,本句只给人读)。
  */
 export declare const RUN_ORPHANED_ERROR = "run orphaned by engine restart";
 /** File 车道两个孤儿落款写口共用的那一句(`heldBy` = 接管臂的前任持有者描述;boot 回收臂不带)。 */
 export declare function buildRunOrphanedError(heldBy?: string): string;
 /**
- * run 行上是不是一份**持有者死亡判决**:`failed`,且 `error` 是 run 店的两只死亡落款之一 —— {@link RUN_STALLED_ERROR}(三只 run 店的
- * `reapStale`:心跳过期 ⇒ 实例丢了)或 {@link RUN_ORPHANED_ERROR}(File 车道:前世进程随重启没了;接管臂带括注)。判决只说「持有它的那个进程
- * 死在这条腿收场之前」,不说是谁 —— 持有者是谁读行上的 `instanceId`(两只落款都不改它)。唯一读者 = 用户输入受理账本的收敛判词
- * (`src/user-input-ledger.ts` `judgeOpen`);改任一句落款 = 改那条判据,所以写者与读者都只引用本模块的常量。
- * 正常失败(别的 error)/ park 过期收割(`approval expired before decision`:腿 park 过)都**不是**死亡判决。
+ * run 店的两只**死亡判决机读码**(行上 `errorCode` 列;`GET /v1/runs/:id` 的 `errorCode` 读它)—— 与两句死亡落款一一对应:
+ * {@link RUN_STALLED_ERROR} ⇔ `run.stalled`(三只 run 店的 `reapStale`:心跳过期 ⇒ 实例丢了)、{@link RUN_ORPHANED_ERROR}(含接管臂的括注形)⇔
+ * `run.orphaned`(File 车道:前世进程随重启没了)。码是判据,句子只给人读。族 `run.` = run 店自己写在行上的生命周期判决(core 不铸这一族)。
  */
-export declare function isHolderDeathVerdict(run: Pick<RunRecord, "status" | "error">): boolean;
+export declare const RUN_HOLDER_DEATH_CODES: {
+    readonly stalled: "run.stalled";
+    readonly orphaned: "run.orphaned";
+};
+export type RunHolderDeathCode = (typeof RUN_HOLDER_DEATH_CODES)[keyof typeof RUN_HOLDER_DEATH_CODES];
+/**
+ * 一次性迁移 **M6** 的判据(窗、删法与删后谁接住:窗口见 `plugins/one-time-migrations.ts` 登记表):7.116.0 之前写下的死亡判决行只有句子、码列为空 ——
+ * 该行应有的码。两处用:local 腿的起服写回(`FileRunStore.migrateLegacyHolderDeathCodes`)与 SQL 两孪生行映射里的**读侧半场**(滚动升级窗里旧副本
+ * 还会写这种行,起服写回覆盖不到;本函数随 M6 一起删)。只认两句落款的原字节(接管臂括注形按前缀认);码列已有值 / 非 `failed` / 别的句子 ⇒ 原样。
+ */
+export declare function readLegacyHolderDeathCode(row: {
+    readonly status: string;
+    readonly error: string | null;
+    readonly errorCode: string | null;
+}): string | null;
+/**
+ * run 行上是不是一份**持有者死亡判决**:`failed`,且行上的码是 {@link RUN_HOLDER_DEATH_CODES} 之一。判决只说「持有它的那个进程死在这条腿收场之前」,
+ * 不说是谁 —— 持有者是谁读行上的 `instanceId`(判决不改它)。读者 = 用户输入受理账本的收敛判词(`src/user-input-ledger.ts` `judgeOpen`)。
+ * 旧行(只有句子)由一次性迁移 M6 补上码(起服写回 + SQL 滚动窗的读侧半场,{@link readLegacyHolderDeathCode}),所以这里不再按句子判。
+ * 正常失败(别的码 / 无码)/ park 过期收割(`approval.expired`:腿 park 过)都**不是**死亡判决。
+ */
+export declare function isHolderDeathVerdict(run: Pick<RunRecord, "status" | "errorCode">): boolean;
 export interface RunRecord {
     taskId: string;
     sessionId: string;

package/dist/plugins/store-contracts.js

@@ -6,10 +6,19 @@ export const RUN_ORPHANED_ERROR = "run orphaned by engine restart";
 export function buildRunOrphanedError(heldBy) {
     return heldBy === undefined ? RUN_ORPHANED_ERROR : `${RUN_ORPHANED_ERROR} (claim held by ${heldBy}, which is gone)`;
 }
+export const RUN_HOLDER_DEATH_CODES = { stalled: "run.stalled", orphaned: "run.orphaned" };
+const RUN_HOLDER_DEATH_CODE_WORDS = new Set(Object.values(RUN_HOLDER_DEATH_CODES));
+export function readLegacyHolderDeathCode(row) {
+    if (row.errorCode !== null || row.status !== "failed" || row.error === null)
+        return row.errorCode;
+    if (row.error === RUN_STALLED_ERROR)
+        return RUN_HOLDER_DEATH_CODES.stalled;
+    if (row.error === RUN_ORPHANED_ERROR || row.error.startsWith(`${RUN_ORPHANED_ERROR} (`))
+        return RUN_HOLDER_DEATH_CODES.orphaned;
+    return null;
+}
 export function isHolderDeathVerdict(run) {
-    if (run.status !== "failed" || run.error === null)
-        return false;
-    return run.error === RUN_STALLED_ERROR || run.error === RUN_ORPHANED_ERROR || run.error.startsWith(`${RUN_ORPHANED_ERROR} (`);
+    return run.status === "failed" && run.errorCode !== null && RUN_HOLDER_DEATH_CODE_WORDS.has(run.errorCode);
 }
 export const RUN_STATUS_CLASS = {
     running: "live",

package/dist/plugins/tidb-session-store.js

@@ -141,7 +141,7 @@ export class TiDBSessionStore {
     async listSessions(opts) {
         const params = [];
         const where = ["sm.placement_kind IS NULL"];
-        if (opts.owner) {
+        if (opts.owner !== undefined) {
             where.push(opts.includeUnowned ? "(sm.owner = ? OR sm.owner IS NULL)" : "sm.owner = ?");
             params.push(opts.owner);
         }

package/dist/request-key-closure.js

@@ -28,7 +28,7 @@ const TASK_BODY_DECLARED_KEYS = [
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",
     "rewindFiles", "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",
     "sessionId", "settings", "skills", "suggestNextPrompts", "systemPrompt", "taskId", "toolMaterializeStrategy",
-    "verify", "verifyRounds",
+    "userInvokedSkills", "verify", "verifyRounds",
 ];
 const TASK_BODY_SCENARIO_KEYS = ["businessContext", "lenses", "repo", "rounds", "team"];
 const ACCEPTED_BODY = new Set([...TASK_BODY_DECLARED_KEYS, ...TASK_BODY_SCENARIO_KEYS]);

package/dist/run-local.d.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { type AskRequest, type Brain, type TaskSpec } from "@sema-agent/core";
+import { type AskClass, type AskRequest, type Brain, type TaskSpec } from "@sema-agent/core";
 import { type UnattendedPolicyRefusal } from "./tool-approval.js";
 import { type ApprovalBaselineConfigView, type DeploymentGovernanceConfigView } from "./deployment-governance.js";
 import { type ServiceConfig } from "./config.js";
@@ -131,8 +131,10 @@ export interface LocalApproverIo {
  *
  * 🔴 S-694 起本席也服**三张审批名单**产的 ask(审批基线取 live 席,见 {@link RUN_LOCAL_APPROVAL_SEAT}):
  * `APPROVAL_REQUIRE` / `APPROVAL_NEVER_AUTO` 命中 ⇒ 策略 `ask` ⇒ 落到这里。`AskRequest` 不带是哪条声明产的
- * ask(core 把 `matchedAskRule` 刻意留在闸内、不上请求),所以无 TTY 拒句**列出**可能产门的全部旋钮,
- * `APPROVAL_DENY` 也点名(它当场拒、不经本席 —— 运维排查「为什么这只工具不跑」时要在同一句里看到它)。
+ * ask(core 把 `matchedAskRule` 刻意留在闸内、不上请求),但带这一问的**类**(`classes`,core 7.37.0 起)。
+ * 🔴 无 TTY 拒句的出路**按这一问的类说话**({@link NO_TTY_ASK_CLASS_ROW} 一张闭集表:每类 ⇒ 一种出路):没人表态的服务器工具调用指 `APPROVAL_GRANT`,
+ * 写下的 ask 名单指名单旋钮(`APPROVAL_DENY` 也点名 —— 它当场拒、不经本席),部署强制要人答的问(`operator_forced`)列「one of」能铸它的来源、shell 地板(`shell_floor`)另一句只列铸它的旋钮,其余各类**不点任何旋钮**、只说去终端答;
+ * 类缺席 ⇒ 说实话(「引擎没有说明这一问的类」),不回落成全量旋钮清单(那句对多数类是错的出路)。
  *
  * 🔴 非 TTY 臂答**拒**(真 deny),**绝不答 `"unavailable"`**:后者被 core 读成「席位够不到」并**改道
  * `suspendAsk`**(dist `core/hooks.js` 的 `approverUnavailable` 重投)。今天本腿无店 ⇒ 那条改道无处
@@ -149,6 +151,37 @@ export interface LocalApproverIo {
 /** 本席的形:core `OnAsk` 的函数臂(`"allow"` / `"deny"` 两个字面臂本席从不用)—— 人的答是布尔,没有人被问的拒是部署政策拒对象;
  *  结构上可赋给 `OnAsk`。 */
 export type LocalApprover = (req: AskRequest, signal?: AbortSignal) => Promise<boolean | UnattendedPolicyRefusal>;
+/**
+ * 无 TTY 拒句里**出路**的种类(闭集)。每一类问对应一种({@link NO_TTY_ASK_CLASS_ROW});`terminal_only` = 没有本部署的旋钮能放行这一问,只剩去终端答。
+ * 说出口的三种按 {@link NO_TTY_SPOKEN_REMEDIES} 的顺序各说一次(一问可以折叠多类 ⇒ 多种出路,顺序恒定)。
+ */
+declare const NO_TTY_SPOKEN_REMEDIES: readonly ["grant", "approval_lists", "deployment_mandate", "shell_gate"];
+type NoTtySpokenRemedy = (typeof NO_TTY_SPOKEN_REMEDIES)[number];
+type NoTtyRemedy = NoTtySpokenRemedy | "terminal_only";
+/**
+ * 一类问 ⇒ 这条腿上它的出路。**穷尽表**:core 的 `ASK_CLASSES` 加一类 ⇒ 这里 tsc 红(`Record<AskClass, …>` 少一键),新类必须在这里表态,
+ * 不会悄悄落成「没有出路」。本仓知道而 core 不知道的只有一件:**哪只部署旋钮会产哪一类问**(逐类的产地见各行):
+ *  · `unstated`:没有任何层表态的服务器工具调用(core 7.40.0)—— 运维为自己接的服务器表态的地方是 `APPROVAL_GRANT`(`run-local` 没有请求体,写不了 `settings.permissions.allow`);
+ *  · `ask_rule`:写下的 ask 规则 —— `APPROVAL_REQUIRE` / `APPROVAL_NEVER_AUTO`(`operatorAsk`)与治理层的 commandPolicy ask 名单(同一只铸点);请求体的
+ *    `settings.permissions.ask` 到不了这条腿(本文件不 import 任何请求受理 / `task-settings`,`run-local` 的 spec 自铸);
+ *  · `operator_forced`:部署**强制**要人答的问 —— 能铸它的来源(真 Runner × `applyLocalGovernance` 亲读类集,读数在 `test/run-local.test.ts` S-1100 ⑨ 各格):`APPROVAL_NEVER_AUTO`
+ *    (`operatorAlwaysHumanAsk` 盖部署出身;类集 `[ask_rule, operator_forced]`)与 `runtime.commandPolicy`(ask 条目 ⇒ `[ask_rule, operator_forced]`,同一只铸点;allowlist 形里没列的命令 ⇒ `[operator_forced]`)。
+ *    读码补全(未亲跑):耐久资源耗尽的「恒问人」同走 `operatorAlwaysHumanAsk`、SUP 路由的 capability-danger 门同走它 —— 两者都要 checkpoint 店 / 路由器,run-local 没有;本仓没有给 `spec.tools` 盖部署工具标记的旋钮
+ *    (grep `egress: true` / `irreversibility` 字面量零命中),core 的 A2A 隔离对端形本仓也不设。所以「one of」两项就是这条腿上能铸它的全部来源;
+ *  · `shell_floor`:shell 地板被抬到 always —— `AUTONOMY=ask`(`autonomyOverrides`)与 `MANUAL_MODE_SHELL_GATE=always`,真 Runner 读数两者的类集都是 `[shell_floor]`(**不是** `operator_forced`):
+ *    单独一句,不与 `operator_forced` 的来源混在一起 —— 混说会把 `APPROVAL_NEVER_AUTO` 的问指到一定没设的 `AUTONOMY`;
+ *  · 其余:引擎自己的问(写门 / 形状层 / 写保护 / 探针 / 钩子 / 组织规则 / 引擎的守卫 / 工具标记 …)没有一只本部署旋钮能放行 —— 只说去终端答。
+ *    不借 core 的 `headlessApprovalRemedy`:那一句是给**库的调用方**的出路(「wire an approver (`onAsk`)」「run with `permissionMode: "bypassPermissions"`」),
+ *    而本腿的席**已经接好**(缺的是终端),也没有任何命令行旗给 `permissionMode` —— 照搬会把运维指向一个不存在的旋钮。
+ *
+ * `autoBudgetReleases`:`APPROVAL_AUTO_BUDGET` 能放行这类问吗(读 `createDurableAskPolicy` 的预算臂:只放行**没进 `APPROVAL_NEVER_AUTO`、耐久资源没耗尽**的
+ * `APPROVAL_REQUIRE` 命中,换成一句带理由的 allow)。按 `classes` **整体**读:集里每一类都放得行才建议预算 —— 折叠了别的类(`operator_forced` 等)说明另一层的问仍在,
+ * 预算放不掉它(与 {@link unattendedAnswers} 读整体同一律)。
+ */
+export declare const NO_TTY_ASK_CLASS_ROW: Readonly<Record<AskClass, {
+    readonly remedy: NoTtyRemedy;
+    readonly autoBudgetReleases: boolean;
+}>>;
 export declare function createLocalApprover(io: LocalApproverIo): LocalApprover;
 export declare function promptYesNoOnTty(prompt: string, signal?: AbortSignal, streams?: {
     input: NodeJS.ReadableStream;
@@ -176,4 +209,5 @@ export declare function installRunLocalExitBoundary(deps: {
     logger: Logger;
     exit?: (code: number) => void;
 }): RunLocalExitBoundary;
+export {};
 //# sourceMappingURL=run-local.d.ts.map