@sema-agent/server 7.114.0 → 7.116.0

package/dist/config.d.ts

@@ -285,18 +285,22 @@ export declare function isRosterGateArmed(configCenter: ServiceConfig["configCen
  *   ① env 腿(`APPROVAL_REQUIRE`/`DENY`/`NEVER_AUTO`,下方)—— boot 拒启;
  *   ② 中心下发腿(`runtime.approvalRequire`,config-center/apply-effective.ts)—— 域级拒绝+保前值+warn
  *      (常驻进程不 crash);
- *   ③ per-request 腿(`settings.permissions.{ask,deny}`,task-settings.ts)—— 该请求 422。
+ *   ③ per-request 腿(`settings.permissions.{ask,deny}`,task-settings.ts;S-654 (c) 起 `allow` 同判)—— 该请求 422;
+ *   ④ env 腿 `APPROVAL_GRANT`(7.115.0,运维的 allow 规则,与 ③ 的 allow 桶同一个消费者 `rule-policy`)—— boot 拒启({@link approvalGrantRefusal})。
  *
  * 五种拼法:
  *   - CC 形规则条目(`Bash(ps:*)`/`Edit(src/**)`,[ref] [ref]§七 装机实测):CC 的权限规则 DSL 写法。这些
  *     名单比的是**整串工具名**,带括号那串不是任何活工具的名字 ⇒ 永不匹配。指引=按命令名走
  *     `runtime.commandPolicy`,整条 shell 进门走 `MANUAL_MODE_SHELL_GATE=always`。判别式见
  *     {@link findCcRuleFormNames}(它同时是 `allow` 腿的**唯一**判据,见下方例外说明)。
- *   - 退役名(`bash`/`Task`/`KillShell`…):core `RETIRED_TOOL_NAMES` 静态表,指引=现役名。
- *   - pre-prefix 短名(`figma__x`):v4 自动加前缀的折叠面已删,实挂名恒带 `mcp__`,指引=补全前缀。
- *   - 不完整 MCP 名(`mcp__`、`mcp__figma`):前缀对但缺段——MCP 实挂名恒是 `mcp__<server>__<tool>` 三段形,
- *     少一段同样永不匹配。旧判据「含 `__` 且 protocolOf 认不出」放过了这一族(前缀恰好认得出),从另一侧
- *     漏出去,失守方向与 `figma__x` 完全相同。
+ *   - 退役名(`bash`/`Task`/`KillShell`…)与 pre-prefix 短名(`figma__x`):S-1047(core 7.41.0 #1156)起判据是 core 导出的
+ *     **那一只** `judgeRuleToolName`(准备阶段、两只会话规则店、本仓会话规则写口同调),本函数零手写臂;指引 = core 表给的现役指引 /
+ *     补全协议前缀。
+ *   - 够不着挂载工具的协议名:缺段(`mcp__`、`mcp__srv__`、`mcp____x`)与**对端段铸不出**(`mcp__github.com`、`mcp__github.com__*`、
+ *     超长 / 归一后带连串下划线的服务器段;服务器段带通配的 `mcp__*` 单列判词 `wildcard_peer`)—— 前缀对,但引擎铸注册名时归一对端段,而规则对对端段逐字比,永不匹配。
+ *     判官与句子是 `namespaced-rule-name.ts` 的那**一只**(判据 = core `mintNamespacePrefix` 的自铸对照;会话规则写口两腿与 SQL 店写口同调),
+ *     本文件零手写臂。修前(7.116.0 之前)这里只有缺段一臂外加一条只排 `*` 的特例(`coversAServer`),对端段带点号 / 超长的覆盖形在每个面都照收。
+ *     ⚠️ 两段覆盖形 `mcp__<server>`(服务器段是自铸形)够得着(S-1047 收掉的分叉,见下)。
  *   - **core 的文法编不出来的串**(名字里带反斜杠、单条 >512 字符、空串):判词取自 core 自己的
  *     `validatePermissionRules`,见 {@link uncompilableRuleGuidance}。[ref]①([ref])补齐 ——
  *     此前只有 `ask` 腿(经 `createPermissionRulePolicy` 的 throw)拒得出这一族,`deny` 静默 no-op。
@@ -312,12 +316,12 @@ export declare function isRosterGateArmed(configCenter: ServiceConfig["configCen
  * `<ns>__<server>__*` / `<ns>__<server>__<glob>` 在**每一条**腿上都是**真判**,不再是
  * 「放行进 no-op」—— 而那正是 [ref] 病形(`APPROVAL_DENY=mcp__figma__*` 判 allow)的根。
  *
- * ⚠️ 仍然拒的那一格,理由**换了**(别再照旧引「approval.ts 还不认」):`<ns>__<peer>` **两段形**
- * (`mcp__figma`)core 全家解成 covering,本函数判它「缺段」拒。挡它的不再是消费腿的能力,而是
- * **一名两义**:同一个 `mcp__figma` 既可能是运维想写的「整台服务器」,也可能是他把三段名写漏了一段
- * (`mcp__figma__get_file` 少打一截),两者在 boot 期无 roster 可判——所以三条腿一律响亮拒,并在
- * 指引里直接给出**无歧义**的等价写法 `mcp__figma__*`(见下方 guidance)。放宽两段形是一次
- * behavior-facing 的放宽(三条腿同时变宽,且方向是「更少拒绝」),要走独立批的三问,不是本函数的补丁。
+ * 🔴 **S-1047(core 7.41.0 #1156)收掉的分叉:两段覆盖形 `<ns>__<server>`(`mcp__figma`)自 7.116.0 起受理**。core 全家把它解成
+ * covering(这台服务器的每一只工具,与 `mcp__figma__*` 同义),core 的判词 `judgeRuleToolName` 判它 `current`,本仓会话规则写口也一直
+ * 收它;而本函数此前以「一名两义」(运维也可能是把三段名写漏了一段)拒它,句子却说它「永远不生效」—— 对它不成立,且同一个名字在本仓两张表上
+ * 两种答案。收成一个答案:受理。代价(三问在 CHANGELOG 7.116.0):少了「三段名漏打一截」的那一次拦截 —— 想要一只工具就写全名;
+ * 拒放集合的变化逐条在 MIGRATION 7.116.0 节。服务器段带通配(`mcp__*`)仍拒(core 的匹配器对服务器段逐字比,一只都够不着;7.116.0 起它是
+ * 「对端段铸不出」的一例,不再单列)。
  */
 export interface UnmatchableToolName {
     name: string;
@@ -327,28 +331,50 @@ export interface UnmatchableToolName {
  * S-177(core 7.9.0 [ref])—— **这条名单条目喂给谁**,决定「永不匹配」这句话怎么判。两个消费者形态:
  *
  *  · `"tool-name-table"` —— 消费者按**整串工具名**比对(精确 ∪ covering):env `APPROVAL_*` 三键与
- *    中心下发 `runtime.approvalRequire`(消费者 `createDurableAskPolicy`),**以及**
- *    `settings.permissions.allow`(消费者 core 的 `createAllowDenyPolicy` 的 allow 位)。带括号的内容形
+ *    中心下发 `runtime.approvalRequire`(消费者 `createDurableAskPolicy`)。带括号的内容形
  *    在这里永远匹配不上任何活工具名 —— 与引擎的规则文法认不认得它**无关**,是这条腿的比对方式决定的,
  *    所以内容形照旧响亮拒 + 指路。
  *  · `"rule-policy"` —— 消费者是 core 的**规则编译器**(`createPermissionRulePolicy`):
- *    `settings.permissions.deny` 与 `.ask`(S-177 / core 7.9.0 起两张表都走编译器)。引擎自此**真的按内容
- *    匹配**它们(`Bash(rm -r:*)` / `Edit(~/.sema/**)`),所以本仓不许再替它拒 —— 判据整条交回 core 的
- *    `validatePermissionRules`,按这张表自己的 behavior 问。
- *
- * 🔴 **不对称不是特判,是从「消费者是谁」自然导出的**:`allow` 之所以豁免名字形与文法两族(退役名 /
- * 短名 / 反斜杠 / 超帽),是因为它是**白名单** —— 一个匹配不上的条目让白名单空掉 ⇒ 一切都不在白名单
- * ⇒ fail-CLOSED 且当场可见,那是可接受的另一种失败形;而内容形不同,它是一个 CC 用户为了**少弹窗**
- * 写下的拼法族错,静默代价是整只 Bash 不可用。
+ *    `settings.permissions.deny` / `.ask`(S-177 / core 7.9.0 起)与 `.allow`(S-654 (c) / 7.115.0 起;修前是
+ *    `createAllowDenyPolicy` 的名单位)。引擎**真的按内容匹配** deny / ask 的内容形(`Bash(rm -r:*)` /
+ *    `Edit(~/.sema/**)`),所以本仓不许再替它拒 —— 判据整条交回 core 的 `validatePermissionRules`,按这张表
+ *    自己的 behavior 问(allow 侧 core 只收工具名形,内容形由 core 判拒)。
+ *
+ * S-654 (c) 前这里还有一条「`allow` 豁免名字形与文法两族」的不对称,前提是 allow 为白名单(匹配不上 ⇒ 全拒,
+ * fail-closed 且当场可见);allow 改成规则后那条前提不在了(匹配不上 ⇒ 什么也不放行、照常问,写的人收不到信号),豁免随之删除。
  */
 export type RuleEntryConsumer = "tool-name-table" | "rule-policy";
-export declare function findUnmatchableToolNames(names: readonly string[], opts: {
-    consumer: RuleEntryConsumer;
-    behavior: RuleBehavior;
-    pathBases?: PathRuleBases;
-}): UnmatchableToolName[];
-/** {@link findUnmatchableToolNames} 的成句形——三条腿的文案同源(只有前缀/出口不同)。 */
-export declare function formatUnmatchableToolNames(source: string, bad: readonly UnmatchableToolName[]): string;
+/** {@link unmatchableToolNamesRefusal} 的判据入参:这张表喂给谁(名表 / 规则编译器)、按哪种态度问 core 的文法、路径基。 */
+export interface UnmatchableToolNameJudgment {
+    readonly consumer: RuleEntryConsumer;
+    readonly behavior: RuleBehavior;
+    readonly pathBases?: PathRuleBases;
+}
+/**
+ * 「这张表里有永远不会生效的条目」的**判据与拒因句,同一只函数**(返回 `undefined` = 通过;拒 ⇒ 句子 + 被点名的条目)。
+ * 五条腿全调它:env `APPROVAL_REQUIRE` / `APPROVAL_DENY` / `APPROVAL_NEVER_AUTO`(拒启)、中心下发 `governance.approvalRequire`(整组拒)、
+ * 请求体 `settings.permissions.{allow,ask,deny}`(422)、运维 `APPROVAL_GRANT`(拒启)。修前判据(`findUnmatchableToolNames`)与成句
+ * (`formatUnmatchableToolNames`)是两只导出,句子里那半句(「这些表都是整串逐字比对」)只对名表成立 —— 规则编译器的
+ * 三只桶(与 `APPROVAL_GRANT`)是按规则文法编、按 covering 匹配的,不是整串比对。
+ *
+ * 句子对两种消费者、三种态度都成立:每一条要么永远匹配不到活工具(退役名 / 无协议前缀的短名 / 缺段或对端段铸不出的协议名 / 名表里的内容形),要么编不成
+ * 一条规则(core 文法的判词原样带出);名字按写的样子读,不做别名折叠、不补协议前缀。逐条的「为什么 / 怎么改」在 `→` 之后。
+ */
+export declare function unmatchableToolNamesRefusal(source: string, names: readonly string[], judgment: UnmatchableToolNameJudgment): {
+    readonly message: string;
+    readonly names: readonly string[];
+} | undefined;
+/**
+ * 7.115.0 —— 运维 allow 规则 `APPROVAL_GRANT` 的**拒启判据与拒因句**(同一只函数;`config-invariants.ts` 的 `…Refusal` 形:
+ * 返回句子 = 拒,`undefined` = 通过)。判据与请求腿的 `settings.permissions.allow` 是**同一只**:
+ *  ① 名字形与 core 文法 —— {@link unmatchableToolNamesRefusal},消费者 `rule-policy`、behavior `allow`(退役名 / 无前缀短名 / 缺段或对端段铸不出的协议名 /
+ *     反斜杠 / 超长 / 内容形与参数级的 allow;句子点名哪一条、为什么、怎么改);
+ *  ② 整表试编一次 —— 编的就是治理折叠里那一只(`runtime-governance.ts` {@link compileApprovalGrantLayers}),于是 core 的整表帽这类
+ *     只在编译时才抛的判据也在启动时响亮,而不是每个任务一次 500。
+ * 没有 `pathBases`:运维的规则不挂在任何一条任务的根上,而 allow 文法本来只收工具名形(路径形的 allow core 拒编,在 ① 里就拒了)。
+ * 坏值**不许**静默丢掉那一条后照常起:运维以为放行了,无人值守腿照旧拒 / 停驻,没有任何信号指回这里。
+ */
+export declare function approvalGrantRefusal(names: readonly string[]): string | undefined;
 /**
  * [ref] 件B/C/D —— 三条**部署治理声明**的 env 解析(auth 域的一段,fail-loud 全在这里)。
  *

package/dist/config.js

@@ -3,7 +3,7 @@ import { DEFAULT_MODEL_REF } from "./model-select.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, parseRuleText } from "@sema-agent/core";
+import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, CENTER_CREDENTIAL_ENV } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -18,10 +18,11 @@ import { buildReadFacePostureNotice, readFaceForPosture } from "./read-face-post
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { describeUnreachableNamespacedRuleName, ruleEntryToolName, unreachableNamespacedRuleNameOf } from "./namespaced-rule-name.js";
 import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
-import { AUTONOMY_MODES } from "./runtime-governance.js";
+import { APPROVAL_GRANT_SOURCE, AUTONOMY_MODES, compileApprovalGrantLayers } from "./runtime-governance.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
@@ -1226,14 +1227,16 @@ function uncompilableRuleGuidance(name, behavior, pathBases) {
     const issue = issues[0];
     if (issue === undefined)
         return undefined;
-    const ccGuidance = issue.code === "unsupported.bash_prefix" || issue.code === "unsupported.file_glob" ? ccRuleFormGuidance(name) : undefined;
-    if (ccGuidance !== undefined)
-        return ccGuidance;
+    if (behavior === "allow" && (issue.code === "unsupported.bash_prefix" || issue.code === "unsupported.file_glob" || issue.code === "invalid.allow_param_rule")) {
+        return (`${issue.code} — ${issue.message}. An allow rule list compiles tool-name rules only (an exact name, or mcp__<server>__* / ` +
+            `a2a__<peer>__* for every tool on that peer); a content-form standing approval lives in the persisted-rule store ` +
+            `(/v1/rules/cc-import, or keep the rule when you answer the call's card)`);
+    }
     return (`${issue.code} — core's rule grammar cannot compile this name (${issue.message}), so a table keyed by it matches nothing. ` +
         `Tool names carry no backslashes and are far shorter than the 512-character rule cap; check the spelling, and use ` +
         `mcp__<server>__* / a2a__<peer>__* for "every tool on that peer"`);
 }
-export function findUnmatchableToolNames(names, opts) {
+function findUnmatchableToolNames(names, opts) {
     const out = [];
     for (const name of names) {
         if (opts.consumer === "tool-name-table") {
@@ -1243,34 +1246,48 @@ export function findUnmatchableToolNames(names, opts) {
                 continue;
             }
         }
-        if (opts.behavior === "allow")
-            continue;
-        const retired = RETIRED_TOOL_NAMES.get(name);
-        if (retired !== undefined) {
-            out.push({ name, guidance: retired });
+        const subject = opts.consumer === "tool-name-table" ? name : ruleEntryToolName(name);
+        const verdict = judgeRuleToolName(subject, NO_DECLARED_TOOL_NAMES);
+        if (verdict.kind === "retired") {
+            out.push({ name, guidance: verdict.guidance });
             continue;
         }
         const uncompilable = uncompilableRuleGuidance(name, opts.behavior, opts.pathBases);
-        const subject = opts.consumer === "tool-name-table" ? name : (() => { const parsed = parseRuleText(name, opts.behavior); return "rule" in parsed ? parsed.rule.tool : name; })();
         if (uncompilable !== undefined) {
             out.push({ name, guidance: uncompilable });
             continue;
         }
-        const ns = protocolOf(subject);
-        if (ns === undefined) {
-            if (subject.includes("__"))
-                out.push({ name, guidance: `pre-prefix short form — the live name carries a protocol prefix: ${PROTOCOL_TABLE.map((e) => `${e.prefix}${presentToolName(name)}`).join(" or ")}` });
+        if (verdict.kind === "unprefixed_namespace") {
+            out.push({ name, guidance: `pre-prefix short form — the live name carries a protocol prefix: ${PROTOCOL_TABLE.map((e) => `${e.prefix}${presentToolName(name)}`).join(" or ")}` });
             continue;
         }
-        if (ns.parse(subject) === undefined) {
-            out.push({ name, guidance: `incomplete ${ns.id} name — the live form is ${ns.prefix}<server>__<tool>, or ${ns.prefix}<server>__* to cover every tool on that server` });
-        }
+        const unreachable = unreachableNamespacedRuleNameOf(subject);
+        if (unreachable !== undefined)
+            out.push({ name, guidance: describeUnreachableNamespacedRuleName(unreachable) });
     }
     return out;
 }
-export function formatUnmatchableToolNames(source, bad) {
-    return (`${source} names tool(s) that can never match a live tool (these lists are RAW whole-name comparisons — core 5.0.0 RB-476 removed the alias/auto-prefix folds): ` +
+const NO_DECLARED_TOOL_NAMES = new Set();
+export function unmatchableToolNamesRefusal(source, names, judgment) {
+    const bad = findUnmatchableToolNames(names, judgment);
+    if (bad.length === 0)
+        return undefined;
+    const message = (`${source} has ${bad.length === 1 ? "an entry" : "entries"} that can never take effect — ${bad.length === 1 ? "it" : "each"} would never match a live tool or cannot be compiled into a rule ` +
+        `(names are read exactly as written: no alias folding, no protocol prefix added): ` +
         bad.map((b) => `${presentToolName(b.name)} → ${b.guidance}`).join("; ")).replace(CONTROL_AND_BIDI_STRIP_RE, "");
+    return { message, names: bad.map((b) => b.name) };
+}
+export function approvalGrantRefusal(names) {
+    const unmatchable = unmatchableToolNamesRefusal(APPROVAL_GRANT_SOURCE, names, { consumer: "rule-policy", behavior: "allow" });
+    if (unmatchable !== undefined)
+        return unmatchable.message;
+    try {
+        compileApprovalGrantLayers(names);
+    }
+    catch (e) {
+        return e instanceof Error ? e.message : String(e);
+    }
+    return undefined;
 }
 function streamApprovalConfig(gates) {
     const cfg = {
@@ -1337,9 +1354,9 @@ function parseApprovalDomain(ctx) {
     const dgHmacKeys = parseApprovalHmacKeys(process.env.APPROVAL_HMAC_KEYS, announceKeySetRejection("APPROVAL_HMAC_KEYS"));
     const durableApproval = postureOn("DURABLE_APPROVAL", infraReady);
     const rejectUnmatchableToolNames = (envName, names) => {
-        const bad = findUnmatchableToolNames(names, { consumer: "tool-name-table", behavior: "deny" });
-        if (bad.length > 0)
-            throw new Error(formatUnmatchableToolNames(envName, bad));
+        const unmatchable = unmatchableToolNamesRefusal(envName, names, { consumer: "tool-name-table", behavior: "deny" });
+        if (unmatchable !== undefined)
+            throw new Error(unmatchable.message);
         return names;
     };
     return {
@@ -1353,6 +1370,12 @@ function parseApprovalDomain(ctx) {
         resourceSuspendMaxSlices: nonNegativeIntEnv("RESOURCE_SUSPEND_MAX_SLICES", "跨片 slice 数上限"),
         approvalAutoBudget: clampEnvWithWarn("APPROVAL_AUTO_BUDGET", "0", 0, 10000),
         approvalNeverAuto: rejectUnmatchableToolNames("APPROVAL_NEVER_AUTO", csv("APPROVAL_NEVER_AUTO")),
+        approvalGrant: ((names) => {
+            const refusal = approvalGrantRefusal(names);
+            if (refusal !== undefined)
+                throw new Error(refusal);
+            return names;
+        })(csv("APPROVAL_GRANT")),
         approvalHmacKeys: dgHmacKeys,
         directApprovalDoor,
         sensitiveWritePatterns: ((raw) => {
@@ -2296,7 +2319,7 @@ const MODEL_PLANE_GROUP_KEYS = [
     "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "modelQuotaWeights", "tiers", "projects", "roles", "atModelAllowlist", "cascadeLadder", "degrade",
 ];
 const APPROVAL_GROUP_KEYS = [
-    "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
+    "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto", "approvalGrant",
     "approvalHmacKeys", "durableApproval", "durableApprovalSource", "streamAskWindowMsSource", "directApprovalDoor", "directDoorActive", "resourceSuspend",
     "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
     "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "autoModeClassifierFallback", "autoModeClassifierTimeoutMs", "crossSessionInbound", "crossSessionDialogExpiry",

package/dist/deployment-governance.d.ts

@@ -11,6 +11,9 @@ export interface DeploymentGovernanceConfigView {
     readonly commandPolicy?: ServiceConfig["commandPolicy"];
     readonly manualModeShellGate?: ServiceConfig["manualModeShellGate"];
     readonly sensitiveWritePatterns: ServiceConfig["sensitiveWritePatterns"];
+    /** 7.115.0:运维的 allow 规则(`APPROVAL_GRANT`)—— 原串交给折叠属主编成叶(`runtime-governance.ts` `compileApprovalGrantLayers`)。
+     *  必填:三条消费腿的切面都要点名它,漏了是编译错,不是一条腿上静默没有这只旋钮。 */
+    readonly approvalGrant: ServiceConfig["approvalGrant"];
     /**
      * 本部署的**本地店根**(`LOCAL_DATA_ROOT → CONFIG_LOCAL_DIR → AGENT_DATA_DIR → ~/.ai-agent`)—— 在本口只喂
      * **誊本门**(`<localDataRoot>/sessions`)。S-133 起它**不再**当守卫集的 `dataRoot`(那是引擎记忆根,见
@@ -209,7 +212,7 @@ export declare class RelativeTargetLexicalEnv extends StubExecutionEnv {
  * core 的原因。env 只是编译期的占位(compilePatterns 不碰它),真裁决用的是每请求按 lane 铸的那一个。
  */
 export declare function assertGuardPatternsUsable(config: Pick<DeploymentGovernanceConfigView, "sensitiveWritePatterns">): void;
-/** 一条 boot 期运维告警的**载荷**(纯数据 ⇒ `build*`;打给谁、用哪只 logger 归消费腿)。 */
+/** 一条 boot 期运维告警 / 通告的**载荷**(纯数据 ⇒ `build*`;打给谁、用哪只 logger、哪一级归消费腿)。 */
 export interface OperatorWarning {
     readonly event: string;
     readonly fields: Record<string, unknown>;
@@ -230,15 +233,17 @@ export interface GateSeatView {
  * 此前是「这个部署一个门都没接」这个 misconfig 的**唯一**提示,而守卫集只挡那二十来个路径段、其余写
  * 目标照旧无裁决 —— 信号不能因为我们铺了基线就静默消失,所以由我们自己按同一判据说一次。
  *
- * 判据(与信号消失的条件逐字互补):守卫集在场 ∧ 这条腿的审批基线**没有席**(`absent`)∧ 单用户
- * auto-accept 基线不适用。三个量都是部署常量 ⇒ 消费腿在 boot 期说一次,不是每任务一次。
+ * 判据(与信号消失的条件逐字互补):**非门的部署叶在场**(守卫集,或 7.115.0 起运维的 allow 规则 `APPROVAL_GRANT` —— 两者都让
+ * `spec.toolPolicy` 在场、又都不是门:一个只拒守卫段,一个只表态 allow)∧ 这条腿的审批基线**没有席**(`absent`)∧ 单用户
+ * auto-accept 基线不适用。事件名 `tool_policy_only_sensitive_baseline` 是allow 规则之前定的,保留不改(运维的日志告警按它匹配),
+ * 哪一片叶在场写在 `detail` 与 `guardedPatterns` / `grantRules` 两个计数里。三个量都是部署常量 ⇒ 消费腿在 boot 期说一次,不是每任务一次。
  * S-694:席读的是喂审批基线的**同一只**({@link ApprovalSeat})—— `durable` / `live` 两形都有人服 ask、名单
  * 进策略,「守卫集是唯一的策略」这句话在它们上面不成立。今天真发的只剩 HTTP 腿「durable 关 ∧ 多租户」那一形。
  *
  * ⚠️ 单一属主([ref] 件三):HTTP 腿与 run-local 腿共用本判据与文案。两处各写一份 = 一处改了另一处
  * 没改,而两份都长得像对的 —— 那正是本文件存在的理由。
  */
-export declare function buildOnlySensitiveBaselineWarning(config: Pick<DeploymentGovernanceConfigView, "sensitiveWritePatterns">, seat: GateSeatView): OperatorWarning | undefined;
+export declare function buildOnlySensitiveBaselineWarning(config: Pick<DeploymentGovernanceConfigView, "sensitiveWritePatterns" | "approvalGrant">, seat: GateSeatView): OperatorWarning | undefined;
 /**
  * `applyRuntimeGovernance` 的 governance 实参预铸([ref] 件一)。
  *
@@ -253,6 +258,12 @@ export declare function buildOnlySensitiveBaselineWarning(config: Pick<Deploymen
  * 的读法因此不变。
  */
 export declare function createDeploymentGovernanceInputs(config: DeploymentGovernanceConfigView, pathAdjudication: PathAdjudication, roots: DeploymentGovernanceRoots): DeploymentGovernanceInputs;
+/**
+ * 7.115.0 —— 运维 allow 规则的**起服通告**载荷(纯数据 ⇒ `build*`;HTTP 腿与 run-local 腿各在装配时说一次,用 info 级)。
+ * 规则名不是秘密(它们是工具名),所以原样列出;空表 ⇒ `undefined`(不打)。运维只读面上同一个事实另有一处:
+ * `GET /v1/diagnostics/wiring` 的 `serverGates.approvalGrant`。
+ */
+export declare function buildApprovalGrantNotice(config: Pick<DeploymentGovernanceConfigView, "approvalGrant">): OperatorWarning | undefined;
 /**
  * 审批基线 —— `applyRuntimeGovernance` 那个 base 的 `toolPolicy` 座([ref] 件一)。**恒非
  * `undefined`**:治理层是 tighten-only 的叠加层,没有基线可叠时它自己也产不出「门在场」这件事。

package/dist/deployment-governance.js

@@ -61,7 +61,7 @@ export function assertGuardPatternsUsable(config) {
     }
 }
 export function buildOnlySensitiveBaselineWarning(config, seat) {
-    if (config.sensitiveWritePatterns.length === 0 || seat.singleUserAutoAcceptBaseline)
+    if ((config.sensitiveWritePatterns.length === 0 && config.approvalGrant.length === 0) || seat.singleUserAutoAcceptBaseline)
         return undefined;
     switch (seat.approvalSeat) {
         case "durable":
@@ -74,12 +74,17 @@ export function buildOnlySensitiveBaselineWarning(config, seat) {
             throw new Error(`approval seat "${String(unhandled)}" has no arm in the only-sensitive-baseline warning`);
         }
     }
+    const nonGateLayers = [
+        ...(config.sensitiveWritePatterns.length > 0 ? ["the sensitive-path DENY baseline (SENSITIVE_WRITE_PATTERNS)"] : []),
+        ...(config.approvalGrant.length > 0 ? ["the APPROVAL_GRANT allow rules"] : []),
+    ];
     return {
         event: "tool_policy_only_sensitive_baseline",
         fields: {
-            detail: "the sensitive-path DENY baseline (SENSITIVE_WRITE_PATTERNS) is this deployment's ONLY tool policy — writes outside the guarded segments are unadjudicated, and core's own UNGATED warning no longer fires because a policy is now always present",
+            detail: `${nonGateLayers.join(" and ")} ${nonGateLayers.length > 1 ? "are" : "is"} this deployment's ONLY tool policy and not a gate — writes outside the guarded segments are unadjudicated, and core's own UNGATED warning no longer fires because a policy is now always present`,
             remedy: "wire an approval face (DURABLE_APPROVAL / APPROVAL_REQUIRE with a store) or accept the single-user auto-accept baseline",
             guardedPatterns: config.sensitiveWritePatterns.length,
+            grantRules: config.approvalGrant.length,
         },
     };
 }
@@ -108,6 +113,19 @@ export function createDeploymentGovernanceInputs(config, pathAdjudication, roots
         commandPolicy: config.commandPolicy,
         ...(config.manualModeShellGate ? { manualModeShellGate: config.manualModeShellGate } : {}),
         ...(sensitivePathLayers ? { sensitivePathLayers } : {}),
+        ...(config.approvalGrant.length > 0 ? { approvalGrant: config.approvalGrant } : {}),
+    };
+}
+export function buildApprovalGrantNotice(config) {
+    if (config.approvalGrant.length === 0)
+        return undefined;
+    return {
+        event: "approval_grant_in_force",
+        fields: {
+            rules: config.approvalGrant.length,
+            names: [...config.approvalGrant],
+            note: "APPROVAL_GRANT states the allow for the tools these rules name on every leg it is installed on (HTTP submit, durable resume, cross-replica revival of parked background agents, run-local) — those calls are no longer asked for want of a statement; any layer's own deny or ask (approval lists, request settings, session rules, the engine's mode gates) still wins",
+        },
     };
 }
 export function createApprovalBaselinePolicy(config, seat) {

package/dist/fleet/fleet-bus.d.ts

@@ -1,6 +1,5 @@
 import type { TaskNotificationPayload, TerminalCause, WorkflowRun } from "@sema-agent/core";
-import type { RunRecord, UnsuccessfulRunStatus } from "../plugins/store-contracts.js";
-import type { AssertAllKeysHandled } from "../trace/core-keyset-guard.js";
+import type { RunRecord } from "../plugins/store-contracts.js";
 /** [ref] 幽灵行案的单源判别:一条 `task_notification` 只有在 **agent 族 × 终态** 时才允许打
  *  `onChildTerminal`(fleet「subagent 树」只渲 agent 子代)。`background_bash`/`monitor`/`external`
  *  不属 agent fleet 树——它们此前每条都打,fleet-bus 的「无 tick 无 claim」臂给 b\* 与 m\* handle 合成
@@ -674,24 +673,4 @@ export declare function isTerminalFleetStatus(status: FleetTaskStatus): boolean;
 export declare function runStatusToFleet(status: RunStatusForFleet, opts?: {
     awaitingPlanApproval?: boolean;
 }): FleetTaskStatus;
-/**
- * S-213③ —— **编译期同源钉**:fleet 的 `"failed"` 桶必须恰好收下 `RUN_STATUS_CLASS` 判为「非成功终局」
- * 的每一个 core 词。
- *
- * 这个词的病史:`blocked` 曾在本仓有**两个独立写者**且答案互斥 —— 本文件读它为「非成功终局(agent
- * 放弃)⇒ 行离场」,而 `observability/run-terminal.ts` 读它为「治理判决,不是失败 ⇒ 不打行」。两处
- * 各自穷举、各自正确地编译,结果是一条 `report_blocked` 的 run 在面板上离场、在引擎日志里一个字都没有。
- * 语义收归 `plugins/store-contracts.ts` 的那张表之后,本行不再自持判断:表把某个词挪出/挪进
- * `unsuccessful`(或 core 新增一个非成功终态)而上面的 switch 没跟上 ⇒ 下面这条收不敛到 `never` ⇒ tsc 红。
- * (`"error"` 是 server 自有别名、不在那张表的辖域内,故不在本钉的两边出现。)
- */
-type FleetUnsuccessfulBucket = "failed" | "blocked";
-type _GuardFleetUnsuccessfulBucket = AssertAllKeysHandled<Exclude<UnsuccessfulRunStatus, FleetUnsuccessfulBucket>>;
-/** 反向门(与 `core-keyset-guard.ts` 的 `_Guard*Reverse` 同形):桶里留了一个表**不再**判为非成功终局的
- *  词同样红 —— 只有正向门时,把 `blocked` 挪回 `succeeded` 而 switch 照旧塞进 failed 桶,并集覆盖、
- *  差集门一声不吭(本批实测:只加正向门时该变异 tsc rc=0)。两道钉一起加。 */
-type _GuardFleetUnsuccessfulBucketReverse = AssertAllKeysHandled<Exclude<FleetUnsuccessfulBucket, UnsuccessfulRunStatus>>;
-/** 占位使用(防 noUnusedLocals 形 lint;类型别名本身零运行时)。 */
-export type FleetVocabGuards = [_GuardFleetUnsuccessfulBucket, _GuardFleetUnsuccessfulBucketReverse];
-export {};
 //# sourceMappingURL=fleet-bus.d.ts.map

package/dist/hooks/hook-runner.d.ts

@@ -1,4 +1,4 @@
-import { HooksConfig } from "@sema-agent/settings-schema/hooks";
+import { HooksConfig, type HookEventName } from "@sema-agent/settings-schema/hooks";
 import type { Hooks } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
 import type { HookNoticeObservation } from "../fleet/fleet-bus.js";
@@ -80,6 +80,10 @@ export interface ParseHooksConfigResult {
  * 拒放集合相对 7.113.0 的一处放宽(披露在 CHANGELOG / MIGRATION):超过上限的字面别名 matcher 7.113.0 拒(当时字面判不设上限),自 7.114.0 两档都判未判、受理。
  *
  * 错误句只回显**目录里的**别名与正名(闭集字符串),不回显调用方的原字节(S-716 姿势)。
+ *
+ * 🔴 **判决是数据,句子与体的机读位同出一只铸点**(S-1025;client-core 请托,additive):{@link deadToolMatcherIssue} 回 {@link DeadToolMatcherIssue}(event / alias / canonical)
+ * 而不是句子;{@link buildDeadToolMatcherRefusal} 是**唯一**把它铸成拒句 + `field` + `detail` 的函数,受理门只取它的返回、**不解析句子**。体上多出的两键让三端不必解析英文就能把这只拒
+ * 与普通提交失败分流、提示用户改 matcher;句子逐字同 7.114.0、零新码。
  */
 /** 超此长度的 matcher 不在受理面读(两档同一个上限;未判,reason = oversize)。与 {@link MAX_HOOK_COMMAND_CHARS} 同量纲的服务侧防线:真实 matcher(精确名 / 交替 / `mcp__.*`)远在其内;目录全部工具名交替 ~0.5 KiB。 */
 export declare const MAX_MATCHER_EVAL_CHARS = 8192;
@@ -95,13 +99,35 @@ export interface MatcherEvalBudget {
     readonly budgetMs?: number;
     readonly now?: () => number;
 }
+/** 一条受理面判决(纯数据):`event` 事件下的某只 matcher 选中了退役别名 `alias`、却选不中它的正名 `canonical`。`alias` / `canonical` 恒取自 core 静态目录(闭集字符串,不含调用方原字节)。 */
+export interface DeadToolMatcherIssue {
+    readonly event: HookEventName;
+    readonly alias: string;
+    readonly canonical: string;
+}
+/** {@link buildDeadToolMatcherRefusal} 的返回(纯数据):拒句 + 400 体上的两个机读位。`field` 恒为字面 `"settings.hooks"`;`detail` 与 {@link DeadToolMatcherIssue} 同三键(逐个挑出,不 spread)。 */
+export interface DeadToolMatcherRefusal {
+    readonly message: string;
+    readonly field: "settings.hooks";
+    readonly detail: {
+        readonly event: HookEventName;
+        readonly alias: string;
+        readonly canonical: string;
+    };
+}
+/**
+ * 判决 → 拒句 + 机读位。**拒句的唯一铸点**:句子逐字 = 7.114.0 的那一句(`test/hooks-alias-matcher-s995.test.ts` R7 冻结);受理门 `admission.ts` 用返回值填 400 体,
+ * 不从句子里反解字段。
+ */
+export declare function buildDeadToolMatcherRefusal(issue: DeadToolMatcherIssue): DeadToolMatcherRefusal;
 /**
- * fresh 提交面专用判据(S-924 / S-995):配置里第一条「永远打不中」的工具事件 matcher 的拒句;没有 ⇒ undefined。
+ * fresh 提交面专用判据(S-924 / S-995):配置里第一条「永远打不中」的工具事件 matcher 的判决数据({@link DeadToolMatcherIssue});没有 ⇒ undefined。
+ * 拒句与 400 体的机读位由 {@link buildDeadToolMatcherRefusal} 从这份数据铸(S-1025)。
  * 入参是 {@link parseHooksConfig} 已校验过的配置;`depth` 由调用点按车道定(见头注:`taskHooksHonored(config) ? "regex" : "literal"`)。
  * `budget` **仅供测试注入**({@link MatcherEvalBudget});生产调用点只传前两个实参。
  * **只有 `admission.ts` 的 fresh 提交门调它** —— resume 重放不调(理由见上面的头注)。未判的 matcher 过 `recordFailOpen`(tag `MATCHER_UNJUDGED_TAG`)。
  */
-export declare function deadToolMatcherIssue(config: HooksConfig, depth: MatcherEvalDepth, budget?: MatcherEvalBudget): string | undefined;
+export declare function deadToolMatcherIssue(config: HooksConfig, depth: MatcherEvalDepth, budget?: MatcherEvalBudget): DeadToolMatcherIssue | undefined;
 /**
  * 把 wire 上的 untrusted `settings.hooks` 校验成契约 {@link HooksConfig} + 服务侧上限。
  * 错误返回 error 字符串而不 throw——submit 路径 400 fail-loud、resume 防御路径 warn-drop,由调用方选。

package/dist/hooks/hook-runner.js

@@ -142,6 +142,13 @@ function deadAliasInMatcher(matcher, depth, budget) {
     }
     return undefined;
 }
+export function buildDeadToolMatcherRefusal(issue) {
+    return {
+        message: `settings.hooks.${issue.event}: matcher "${issue.alias}" is an alias; tool-event matchers match the tool's wire name (PostToolUse / PostToolUseFailure since 7.107.0) — use "${issue.canonical}"`,
+        field: "settings.hooks",
+        detail: { event: issue.event, alias: issue.alias, canonical: issue.canonical },
+    };
+}
 export function deadToolMatcherIssue(config, depth, budget = {}) {
     const now = budget.now ?? (() => performance.now());
     const deadline = { deadlineMs: now() + (budget.budgetMs ?? ADMISSION_MATCHER_EVAL_BUDGET_MS), now };
@@ -158,7 +165,7 @@ export function deadToolMatcherIssue(config, depth, budget = {}) {
                 recordFailOpen(MATCHER_UNJUDGED_TAG, `event=${event} reason=${verdict.reason} matcherChars=${group.matcher.length}`);
                 continue;
             }
-            return `settings.hooks.${event}: matcher "${verdict.alias}" is an alias; tool-event matchers match the tool's wire name (PostToolUse / PostToolUseFailure since 7.107.0) — use "${verdict.canonical}"`;
+            return { event, alias: verdict.alias, canonical: verdict.canonical };
         }
     }
     return undefined;
@@ -855,6 +862,7 @@ export function createTaskHooks(config, ctx) {
             let currentInput = input;
             let rewritten = false;
             let asked;
+            let allowedFor;
             let unknownDecision = false;
             const contexts = [];
             const deadlineAt = Date.now() + MAX_HOOK_EVENT_TOTAL_SECONDS * 1000;
@@ -868,11 +876,12 @@ export function createTaskHooks(config, ctx) {
                 }
                 if (!m)
                     continue;
+                const groupInput = currentInput;
                 const payload = {
                     ...basePayload(ctx, tctx.permissionMode),
                     hook_event_name: "PreToolUse",
                     tool_name: toolName,
-                    tool_input: currentInput,
+                    tool_input: groupInput,
                     tool_use_id: tctx.toolCallId,
                 };
                 const singles = await runMatchingEntries("PreToolUse", [{ ...group, matcher: undefined }], toolName, payload, ctx, onceFired, deadlineAt, `PreToolUse:${gi}`);
@@ -913,10 +922,13 @@ export function createTaskHooks(config, ctx) {
                             asked = clip(typeof h.permissionDecisionReason === "string" ? h.permissionDecisionReason : "a PreToolUse hook requires approval", MAX_HOOK_FEEDBACK_CHARS);
                         }
                         if (decision === "allow" || decision === undefined) {
-                            if (h.updatedInput !== null && typeof h.updatedInput === "object") {
+                            const rewrites = h.updatedInput !== null && typeof h.updatedInput === "object";
+                            if (rewrites) {
                                 currentInput = h.updatedInput;
                                 rewritten = true;
                             }
+                            if (decision === "allow")
+                                allowedFor = { input: rewrites ? h.updatedInput : groupInput };
                         }
                         else if (decision !== "deny" && decision !== "ask") {
                             unknownDecision = true;
@@ -946,13 +958,11 @@ export function createTaskHooks(config, ctx) {
                     ...buildHookContextField(contexts),
                 };
             }
-            if (rewritten || contexts.length > 0) {
-                return {
-                    action: "allow",
-                    ...(rewritten ? { updatedInput: currentInput } : {}),
-                    ...buildHookContextField(contexts),
-                };
-            }
+            const carried = { ...(rewritten ? { updatedInput: currentInput } : {}), ...buildHookContextField(contexts) };
+            if (allowedFor !== undefined && allowedFor.input === currentInput)
+                return { action: "allow", ...carried };
+            if (rewritten || contexts.length > 0)
+                return carried;
             return undefined;
         };
         hooks.preToolUse = preToolUseHook;
@@ -1324,6 +1334,7 @@ export function composeHooks(deployment, task) {
             let current = input;
             const contexts = [];
             let asked;
+            let allowedFor;
             for (const slot of [d.preToolUse?.bind(d), t.preToolUse?.bind(t)]) {
                 if (!slot)
                     continue;
@@ -1343,6 +1354,10 @@ export function composeHooks(deployment, task) {
                         asked = r;
                         break;
                     case "allow":
+                        if (updatedInput !== undefined)
+                            current = updatedInput;
+                        allowedFor = { input: current };
+                        break;
                     case undefined:
                         if (updatedInput !== undefined)
                             current = updatedInput;
@@ -1362,13 +1377,11 @@ export function composeHooks(deployment, task) {
                     ...buildHookContextField(contexts),
                 };
             }
-            if (current !== input || contexts.length > 0) {
-                return {
-                    action: "allow",
-                    ...(current !== input ? { updatedInput: current } : {}),
-                    ...buildHookContextField(contexts),
-                };
-            }
+            const carried = { ...(current !== input ? { updatedInput: current } : {}), ...buildHookContextField(contexts) };
+            if (allowedFor !== undefined && allowedFor.input === current)
+                return { action: "allow", ...carried };
+            if (current !== input || contexts.length > 0)
+                return carried;
             return undefined;
         };
     }

package/dist/http/admission.d.ts

@@ -52,6 +52,12 @@ export declare const MAX_OUTPUT_SCHEMA_CHARS = 32768;
  * 🔴 **server 侧禁裁列表 / 禁截描述**:渲染归引擎(单一属主)。本函数只判「这一条技能的形能不能用」。
  */
 export declare function validateUserSkills(skills: unknown): string | null;
+/**
+ * core 7.41.0 #1303 —— 顶层技能带 `manifest` 的拒因句(单铸点)。出路只点本服务上**真存在**的旋钮:技能的两只清单
+ * (`allowedTools` / `disallowedTools`)、圈工具 = deny 规则(请求 `settings.permissions.deny` / 运维 `APPROVAL_DENY`)或子代定义的
+ * `agents[].allowTools`、圈写路径 = 会话规则 `allowDirs`(`PUT /v1/sessions/:id/policy`)。
+ */
+export declare const SKILL_MANIFEST_RETIRED = "skill.manifest was retired in core 7.41.0 \u2014 a skill's tools are its allowedTools / disallowedTools now (an allow-rule and a deny-rule source for the run the skill is activated in, never a fence); move manifest.allowTools to allowedTools. To fence tools use deny rules (settings.permissions.deny) or a delegated agent's allowTools; to fence write paths use the session rules' allowDirs";
 export declare function createAdmission(ctx: {
     deps: FlatServiceDeps;
     runnerFor: FlatServiceDeps["runnerFor"];