@sema-agent/server 7.116.0 → 7.117.0

package/dist/observability/permission-rule-events.d.ts

@@ -11,6 +11,9 @@ export declare const PERMISSION_RULE_EVENT_TABLE: readonly [{
 }, {
     readonly event: "skill_allowed";
     readonly meaning: "an activated skill's allowed-tools list cleared the ask for the rest of that run (core decisionReason \"skill\"; today only a skill the request itself carried can do this — this deployment's own skills carry no lists; it clears only the unstated / ordinary questions a persisted allow rule may clear, never a deny / ask rule, an operator list, a governance or shell-floor question, or a mandated one)";
+}, {
+    readonly event: "allowed_tools_allowed";
+    readonly meaning: "the request's allow list (settings.permissions.allow, sent whole to the engine's allow layer) or the deployment's (APPROVAL_GRANT) cleared the ask (core decisionReason \"request_rule\" / \"deployment_rule\"; the log line carries source and the matched entries, the label carries the event word only)";
 }];
 /** 词表里的一个词(闭集)。 */
 export type PermissionRuleEventWord = (typeof PERMISSION_RULE_EVENT_TABLE)[number]["event"];

package/dist/observability/permission-rule-events.js

@@ -16,6 +16,10 @@ export const PERMISSION_RULE_EVENT_TABLE = [
         event: "skill_allowed",
         meaning: "an activated skill's allowed-tools list cleared the ask for the rest of that run (core decisionReason \"skill\"; today only a skill the request itself carried can do this — this deployment's own skills carry no lists; it clears only the unstated / ordinary questions a persisted allow rule may clear, never a deny / ask rule, an operator list, a governance or shell-floor question, or a mandated one)",
     },
+    {
+        event: "allowed_tools_allowed",
+        meaning: "the request's allow list (settings.permissions.allow, sent whole to the engine's allow layer) or the deployment's (APPROVAL_GRANT) cleared the ask (core decisionReason \"request_rule\" / \"deployment_rule\"; the log line carries source and the matched entries, the label carries the event word only)",
+    },
 ];
 const PERMISSION_RULE_EVENT_KINDS = new Set(PERMISSION_RULE_EVENT_TABLE.map((r) => `${PERMISSION_TRACE_PREFIX}${r.event}`));
 export function isPermissionRuleEventKind(kind) {

package/dist/observability/run-terminal.js

@@ -416,7 +416,7 @@ const RISK_DESCRIPTOR_TREATMENT = {
     shellGateDoctrine: "verbatim",
     summary: "text",
     touchedPaths: "text[]",
-    shadowedRule: "text",
+    allowRuleShadowed: "allow-rule-shadows",
     probeReason: "text",
     probeCause: "probe-cause",
 };
@@ -473,12 +473,32 @@ export function redactRiskDescriptor(rd) {
                 out[key] = np;
                 break;
             }
+            case "allow-rule-shadows": {
+                const recs = r[key];
+                if (!Array.isArray(recs))
+                    break;
+                out[key] = recs.map((rec) => {
+                    if (rec === null || typeof rec !== "object" || Array.isArray(rec))
+                        return rec;
+                    const o = rec;
+                    return Array.isArray(o.entries) ? { ...o, entries: strs(o.entries) } : rec;
+                });
+                break;
+            }
             default: {
                 const unhandled = treatment;
                 throw new Error(`unhandled leaf treatment: ${String(unhandled)}`);
             }
         }
     }
+    for (const [key, v] of Object.entries(r)) {
+        if (Object.hasOwn(RISK_DESCRIPTOR_TREATMENT, key))
+            continue;
+        if (typeof v === "string")
+            out[key] = str(v);
+        else if (Array.isArray(v))
+            out[key] = strs(v);
+    }
     return changed ? out : rd;
 }
 const STATS_KEY_TREATMENT = {

package/dist/outbound-dispatcher.d.ts

@@ -55,6 +55,24 @@
  * connect ECONNREFUSED 127.0.0.1:1)`(message 不带代理地址 —— 主会话 F3 裁定,见 {@link OutboundProxyError})。core 的句子一字不改(它逐层展开 cause 链,包装层就是链上多一节)。隧道建好之后的失败(目标的 TLS、
  * 目标的响应)不经这个接缝,不冠代理 —— 那是目标的事。
  *
+ * ── http 目标:绝对 URL 形,不建隧道(S-804;test 黑盒验收 A1)──────────────────────────────────────────────────
+ * 病:undici `ProxyAgent` 的 `proxyTunnel` **代码缺省是 true**(7.30.0 `lib/dispatcher/proxy-agent.js` 构造器 `const { proxyTunnel = true } = opts`;它的文档写缺省 false,
+ * 两处相反,以代码为准)⇒ 修前连 **http 网关**也被对代理发 `CONNECT host:80`;只放行 `:443` CONNECT 的代理(squid 缺省)拒掉它,run 约 175 s 后失败。
+ * 现在构造 `EnvHttpProxyAgent` 时显式 `proxyTunnel:false`:**http 目标 ⇒ 绝对 URL 形请求**(`GET http://host/path`,undici 的 `Http1ProxyWrapper`),**https 目标 ⇒ 照旧 CONNECT**。
+ * 范围是 undici 划的:目标 `http:` **且**代理 URL 也是 `http:`;`https://` 代理 + http 目标 undici 不走绝对 URL 形,仍 CONNECT。
+ * 三件事照旧成立(逐项读实现得出):
+ *  · 代理认证头:`Proxy-Authorization` 由 `ProxyAgent` 构造器从 userinfo 译一次、两条腿共用(隧道腿放进 CONNECT 请求头,绝对 URL 形腿放进每条请求头);
+ *  · `NO_PROXY` 与回环恒直连:路由在 `EnvHttpProxyAgent` / 本文件外壳里判,先于选哪条腿,不受影响;
+ *  · 代理**拨号**失败(拒连 / 解析不了 / 超时 / 代理 TLS)⇒ 仍是 {@link OutboundProxyError}(`factory` 接缝,见 {@link createProxyAgentFactory}),
+ *    建连失败的观察照报 `proxyInUse`;`targetHost` 读对目标(绝对 URL 形请求的 `origin` 是代理、目标在 `path`,见 {@link targetHostOf})。
+ * 🔴 **与 CONNECT 腿不同、读者要知道的三件**(绝对 URL 形里代理的回话是普通 HTTP 响应,不是 CONNECT 的回包):
+ *  ① 代理的 **407** ⇒ {@link OutboundProxyError},与 CONNECT 腿的 407 **同类、同一只铸点**({@link proxyRefusal})。407 按协议只可能来自代理;undici 的 `Http1ProxyWrapper`
+ *     自己把它转成 `InvalidArgumentError`(只留文案、没有状态码位,按结构认不出),所以改在代理客户端那一层({@link ProxyHopClient})**按响应状态码**先认、先于 undici 的转换,
+ *     不看任何文案;
+ *  ② 代理的 **403** 等其余拒绝状态是**普通响应**原样交给调用方 —— 在 HTTP 层与网关自己回的 403 **原理上分不开**(无通用判别式),调用方读到的是「网关回了 403」(接受并披露);
+ *  ③ 请求发出之后的失败(代理中途断流 / 收下连接就关)与目标自己的失败同形、不冠代理(与隧道建好之后的失败同理)。
+ * 保密面:http 目标的请求行与头(含发给网关的凭据头)以明文过代理,代理看得到完整 URL;要对代理保密就用 https 网关(隧道里是密文)。
+ *
  * ── 安全轴 ───────────────────────────────────────────────────────────────────────────────────────
  * 代理 URL 的 userinfo 是凭据(undici 把它译成 `Proxy-Authorization: Basic …`)。它只进 dispatcher,不进任何观测面:姿态
  * ({@link buildOutboundProxyPosture})、拒启句与归因句同一把尺 {@link displayProxyUrl}(形干净只出 `scheme//host[:port]`、过全仓那一只

package/dist/outbound-dispatcher.js

@@ -1,4 +1,4 @@
-import { Agent, Dispatcher, EnvHttpProxyAgent, getGlobalDispatcher, Pool, setGlobalDispatcher } from "undici";
+import { Agent, Client, Dispatcher, EnvHttpProxyAgent, getGlobalDispatcher, Pool, setGlobalDispatcher } from "undici";
 import { isIP } from "node:net";
 import diagnosticsChannel from "node:diagnostics_channel";
 import { buildDisplaySafeUrl, DISPLAY_SAFE_URL_TOKEN } from "./trace/redact.js";
@@ -128,9 +128,12 @@ class ProxyDialPool extends Pool {
         if (data.statusCode === 200)
             return undefined;
         data.socket.on("error", () => undefined).destroy();
-        return new OutboundProxyError(this.shown, this.from, new Error(`proxy answered CONNECT with HTTP ${String(data.statusCode)}`));
+        return proxyRefusal(this.shown, this.from, data.statusCode, "CONNECT");
     }
 }
+function proxyRefusal(shown, from, statusCode, leg) {
+    return new OutboundProxyError(shown, from, new Error(`proxy answered ${leg} with HTTP ${String(statusCode)}`));
+}
 function withDialDeadline(options) {
     const inner = Reflect.get(options, "connect");
     if (typeof inner !== "function")
@@ -153,12 +156,93 @@ function withDialDeadline(options) {
     };
     return { ...options, connect };
 }
-function createProxyClientFactory(v) {
+function createProxyIdentity(v) {
     const vars = [["HTTP_PROXY", v.httpProxy], ["HTTPS_PROXY", v.httpsProxy]].filter(([, raw]) => raw !== "" && URL.canParse(raw));
+    return (url) => {
+        const same = vars.filter(([, raw]) => new URL(raw).href === url.href);
+        const first = same[0];
+        return first === undefined ? undefined : { shown: displayProxyUrl(first[1]), from: same.map(([name]) => name).join("/") };
+    };
+}
+function createProxyClientFactory(v) {
+    const identify = createProxyIdentity(v);
+    return (origin, options) => {
+        const { shown, from } = identify(origin) ?? { shown: displayProxyUrl(origin.href), from: "proxy variable" };
+        return new ProxyDialPool(origin, withDialDeadline(options), shown, from);
+    };
+}
+const PROXY_AUTH_REQUIRED = 407;
+function interceptProxyAuthRequired(handler, refuse) {
+    let abort;
+    return new Proxy(handler, {
+        get(target, prop) {
+            const member = Reflect.get(target, prop, target);
+            if (typeof member !== "function")
+                return member;
+            if (prop === "onConnect") {
+                return (...args) => {
+                    const candidate = args[0];
+                    if (typeof candidate === "function")
+                        abort = (err) => void Reflect.apply(candidate, undefined, [err]);
+                    return Reflect.apply(member, target, args);
+                };
+            }
+            if (prop === "onHeaders") {
+                return (...args) => {
+                    if (args[0] !== PROXY_AUTH_REQUIRED)
+                        return Reflect.apply(member, target, args);
+                    const refusal = refuse();
+                    if (abort !== undefined)
+                        abort(refusal);
+                    else {
+                        const deliver = Reflect.get(target, "onError", target);
+                        if (typeof deliver === "function")
+                            Reflect.apply(deliver, target, [refusal]);
+                    }
+                    return undefined;
+                };
+            }
+            return member.bind(target);
+        },
+    });
+}
+class ProxyHopClient extends Client {
+    shown;
+    from;
+    constructor(origin, options, shown, from) {
+        super(origin, options);
+        this.shown = shown;
+        this.from = from;
+    }
+    dispatch(options, handler) {
+        return super.dispatch(options, interceptProxyAuthRequired(handler, () => proxyRefusal(this.shown, this.from, PROXY_AUTH_REQUIRED, "the request")));
+    }
+}
+function withProxyAttribution(options, shown, from) {
+    const inner = Reflect.get(options, "connect");
+    const connect = typeof inner !== "function"
+        ? undefined
+        : (opts, callback) => {
+            Reflect.apply(inner, undefined, [
+                opts,
+                (err, socket) => {
+                    if (err !== null)
+                        callback(new OutboundProxyError(shown, from, err), null);
+                    else if (socket !== null)
+                        callback(null, socket);
+                    else
+                        callback(new OutboundProxyError(shown, from, new Error("proxy connector returned neither a socket nor an error")), null);
+                },
+            ]);
+        };
+    return { ...options, ...(connect !== undefined ? { connect } : {}), factory: (origin, clientOptions) => new ProxyHopClient(origin, { ...clientOptions }, shown, from) };
+}
+function createProxyAgentFactory(v) {
+    const identify = createProxyIdentity(v);
     return (origin, options) => {
-        const same = vars.filter(([, raw]) => new URL(raw).href === origin.href);
-        const raw = same[0]?.[1] ?? origin.href;
-        return new ProxyDialPool(origin, withDialDeadline(options), displayProxyUrl(raw), same.length > 0 ? same.map(([name]) => name).join("/") : "proxy variable");
+        const text = String(origin);
+        const proxy = URL.canParse(text) ? identify(new URL(text)) : undefined;
+        return new Pool(origin, proxy === undefined ? { ...options } : withProxyAttribution(options, proxy.shown, proxy.from));
     };
 }
 export const OUTBOUND_PROXY_INVALID_CODE = "config.outbound_proxy_invalid";
@@ -171,7 +255,7 @@ export function createOutboundDispatcher(env = process.env) {
         throw refuse("ambiguous-url");
     let proxied;
     try {
-        proxied = new EnvHttpProxyAgent({ httpProxy: v.httpProxy, httpsProxy: v.httpsProxy, noProxy: v.noProxy, clientFactory: createProxyClientFactory(v) });
+        proxied = new EnvHttpProxyAgent({ httpProxy: v.httpProxy, httpsProxy: v.httpsProxy, noProxy: v.noProxy, proxyTunnel: false, clientFactory: createProxyClientFactory(v), factory: createProxyAgentFactory(v) });
     }
     catch (err) {
         throw refuse(err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : "invalid");
@@ -209,8 +293,10 @@ export function classifyOutboundConnectFailure(error) {
     }
     return undefined;
 }
-function targetHostOf(origin) {
-    const text = typeof origin === "string" ? origin : origin instanceof URL ? origin.href : "";
+function targetHostOf(request) {
+    const path = Reflect.get(request, "path");
+    const origin = Reflect.get(request, "origin");
+    const text = typeof path === "string" && /^https?:\/\//i.test(path) ? path : typeof origin === "string" ? origin : origin instanceof URL ? origin.href : "";
     return URL.canParse(text) ? new URL(text).host : "(unreadable origin)";
 }
 let observer;
@@ -263,7 +349,7 @@ function startConnectObserver(logger, nowMs) {
                 call.last = { kind: "other" };
             return;
         }
-        const failure = { targetHost: targetHostOf(Reflect.get(request, "origin")), ...verdict };
+        const failure = { targetHost: targetHostOf(request), ...verdict };
         current.last = { ...failure, atMs: Date.now() };
         logger.warn("outbound_connect_failed", {
             ...failure,

package/dist/permission-rule-list.d.ts

@@ -1,25 +1,23 @@
 /**
- * **规则表的唯一编译口** —— 一张工具名规则表(`allow` / `ask` / `deny` 之一)编成一只 `ToolPolicy`。
+ * **规则表的唯一编译口** —— 一张工具名规则表(`ask` / `deny` 之一)编成一只 `ToolPolicy`。读者:请求腿的 `settings.permissions.{ask,deny}`
+ * 两桶(`task-settings.ts` 的 `deriveSettingsPolicy`)。
  *
- * 两类读者,同一只编译口(编译与校验各只有一份,不在别处另写第二份文法):
- *  · 请求腿的 `settings.permissions.{allow,ask,deny}` 三桶(`task-settings.ts` 的 `deriveSettingsPolicy`);
- *  · 运维的 allow 规则 `APPROVAL_GRANT`(`runtime-governance.ts` 的 `applyRuntimeGovernance`,经部署治理链的单一构造口
- *    `deployment-governance.ts` 交进来 —— HTTP 提交 / durable 续跑 / 停驻后台 agent 的跨副本赎回 / run-local 四条腿同装)。
+ * 🔴 core 7.42.0 起策略只说 deny / ask:allow 规则有且只有引擎 allow 层的两个席位 —— 请求的 `settings.permissions.allow` 整份投
+ * `TaskSpec.allowedTools`(`task-settings.ts` 的 `applyTaskSettings`),运维的 `APPROVAL_GRANT` 投 `RunnerDeps.allowedTools`
+ * (`boot/runner-deps.ts` 的部署姿态座席族)。本口的 `behavior` 型直接是 core 的 `PermissionRule["behavior"]`(不手抄:core 收窄,这里跟着收窄)。
  *
- * 为什么住在一只叶模块里(不留在 `task-settings.ts`):运维那一侧的启动校验在 `config.ts` 里跑(坏值 = 拒启),而
- * `task-settings.ts` 值引 `config.ts` —— 编译口留在那里,`config.ts` 要调它就闭合一只 ESM 装载环。本模块只 import core 与
- * `text-bidi.ts`(纯叶),三处读者引它都不成环。
+ * 为什么住在一只叶模块里(不留在 `task-settings.ts`):本模块只 import core 与 `text-bidi.ts`(纯叶),读者引它不成环。
  */
-import { type PathRuleBases, type RuleBehavior, type ToolPolicy } from "@sema-agent/core";
-/** 一张表里规则条数的上限 —— 请求腿 wire 门(`task-settings.ts` 的三桶判形)读的也是这一个名字:core 的缺省帽是 256,
+import { type PathRuleBases, type PermissionRule, type ToolPolicy } from "@sema-agent/core";
+/** 一张表里规则条数的上限 —— 请求腿 wire 门(`task-settings.ts` 的 deny / ask 两桶判形)读的也是这一个名字:core 的缺省帽是 256,
  *  不对齐的话第 257 条起编译当场抛,等于服务端自己收下的东西自己反悔。 */
 export declare const MAX_PERMISSION_RULES_PER_LIST = 1000;
-/** A name-keyed rule-list ToolPolicy: a tool named by `names` gets `behavior` (an `allow` hit states the allow with
- *  `decisionReason: "rule"`; `ask` tightens to an approval gate; `deny` hard-blocks); every other tool is out of
- *  scope (`defaultAction: "allow"` = this policy has no opinion about anything it does not name). Composed deny-wins
- *  with the rest of the fold, so `ask` / `deny` only ever tighten and an `allow` never overrides a deny or an ask.
+/** A name-keyed rule-list ToolPolicy: a tool named by `names` gets `behavior` (`ask` tightens to an approval gate;
+ *  `deny` hard-blocks); every other tool is out of scope (`defaultAction: "allow"` = this policy has no opinion about
+ *  anything it does not name — core 7.42.0: it states nothing and clears nothing). Composed deny-wins with the rest of
+ *  the fold, so both only ever tighten.
  *
- *  `source` = 这张表**写在哪**(请求腿 `settings.permissions.<桶>`;运维腿 `APPROVAL_GRANT`)。它盖进每条规则(core 的 deny / ask
+ *  `source` = 这张表**写在哪**(请求腿 `settings.permissions.<桶>`)。它盖进每条规则(core 的 deny / ask
  *  句里点名它:`flagged by permission rule "mcp__figma__*" (settings.permissions.ask)`),编不出来时的错误句也点名它;只是出处,
  *  不带任何优先级(层序在各自的折叠里)。
  *
@@ -32,7 +30,7 @@ export declare const MAX_PERMISSION_RULES_PER_LIST = 1000;
  *  `deny:["mcp__figma__*"]` 却**真拦** —— deny 走 `createAllowDenyPolicy`,它用的是 core 的
  *  `namespacedCoveringEntries/Hit`。同族分家,差的只是解析器。
  *
- *  ⇒ **规则表的 policy 面现在同源**:三种态度都由 `createPermissionRulePolicy` 的 covering 车道解,底下是
+ *  ⇒ **规则表的 policy 面现在同源**:两种态度都由 `createPermissionRulePolicy` 的 covering 车道解,底下是
  *  core 的**同一只** `namespacedRuleNameCovers`(协议无关:`mcp__`/`a2a__` 同解;peer 段精确比;工具段 `*`/glob 覆盖)。
  *  本仓**不自写第二套 glob** —— 那正是当年分家的成因。
  *
@@ -56,26 +54,17 @@ export declare const MAX_PERMISSION_RULES_PER_LIST = 1000;
  *     这里;真正新增的是「名字里带反斜杠」「单条 > 512 字符」这两族永不匹配的拼法。
  *     ✅ **不对称已收口([ref]①,[ref] 销)**:codex finding-2 当年如实登记的「同样两族拼法在 `deny`
  *     上仍是静默 no-op」已修 —— 判据搬进单点成文的 `unmatchableToolNamesRefusal`,它拿 core 自己的 `validatePermissionRules`
- *     对同一串跑一遍文法(不自铸第二套判词),于是三张表对这两族说同一句话。S-654 (c) 起 `allow` 也收。
+ *     对同一串跑一遍文法(不自铸第二套判词),于是各表对这两族说同一句话。
  *     ⚠️ 存量 resume:带这两族拼法的**已存 body** 在 resume 腿会 422(resolve-spec 翻)。这**不是**新造的姿态——A3
  *     (`rejectUnmatchableSettingsNames`)早就对存量 body 里的退役名/短名同样抛,且 `applyTaskSettings` 腿有专门的回归钉。
  *     判据同一条:一个**静默不存在的审批门**比一次响亮失败更贵。codex 建议的「给非法存量条目保留旧的逐字比对」被**驳回**:
  *     那正是把 fail-open 请回来。
- *   · `caps.maxRules` 对齐 {@link MAX_PERMISSION_RULES_PER_LIST}(理由见那只常量)。core 的 set-level cap 连 `skip` 都照抛,
- *     所以运维腿的启动校验还要**试编一次**(`approvalGrantRefusal`)才拦得住超帽 —— 判据仍是本函数这一只。
- *   · 不再自铸 `decisionReason:"rule"` —— core 的规则策略本就不铸这个键(allow 命中由 core 自己铸 `"rule"`),且 core 侧唯一区分它的
+ *   · `caps.maxRules` 对齐 {@link MAX_PERMISSION_RULES_PER_LIST}(理由见那只常量);请求腿的受理门先按同一个数拒超帽(400)。
+ *   · 不自铸 `decisionReason` —— core 的规则策略本就不铸这个键,且 core 侧唯一区分它的
  *     两处(prepare-task 的继承 grant 复用判据、park 的 rule-suggestion 门)对 `"rule"` 与 `undefined` **同待**(只把 `"hook"`
  *     排除在外),dist 亲读在案。审计归因改由 `matchedAskRule` + `source` 承担,后者比前者强:它还让 core 的 auto-mode 分类器
  *     **拒绝**替人清掉这条 ask(「运维写下的『每次问我』不是分类器的犹豫」),方向是收紧。
- *
- * 🔴 **S-654 (c)(7.115.0,core 7.40.0 #1065):三种态度同一个编译口,`allow` 也走这里** —— `behavior: "allow"` 的规则命中 = core 带
- *  `decisionReason: "rule"` 的放行 —— allow 规则给出「有人表态」—— 它回答的是没人表态的服务器工具 / A2A 技能调用;内置工具上引擎自己的写门、shell 检查照问,deny / ask 照赢(与参照实现的 `permissions.allow` 在内置工具上**不同**:那边 `allow: ["Edit"]` 跳过编辑确认,这里不放掉引擎的写门);未命中 = `defaultAction: "allow"` 的裸 allow
- *  = 不表态、照常判。修前请求腿的 allow 编成 `createAllowDenyPolicy({ allow })` 的**名单**(名单在场 ⇒ 名单外的工具一律拒),与写它的人要的
- *  「替这些工具表态」方向相反;终端因此从不投这只桶。core 7.40.0 起没人表态的服务器工具调用要问,allow 规则就是那张卡的常设答案
- *  (`mcp__<server>__*` 一条覆盖整台服务器)。allow 规则**不越过** deny / ask:折叠 deny > ask > allow,任何一层的 deny / ask 照赢;
- *  它只在没人反对时给出那句表态。core 的 allow 文法只收工具名形(精确名 / `mcp__`·`a2a__` covering 形),内容形放行(`Bash(npm:*)` /
- *  `Edit(src/**)` / 参数级)core 拒编,两条腿与 deny / ask 同一个出口(判据 `unmatchableToolNamesRefusal`)。
- *  7.115.0 起运维的 `APPROVAL_GRANT` 也编在这里(无人值守腿没有请求体,那是运维为自己接的服务器表态的唯一位置)。 */
-/** `behavior` = 这张表的态度 —— 型直接是 core 的 `RuleBehavior`(不手抄:core 加一种态度,这里与它同步、读者 tsc 上见到)。 */
-export declare function createRuleListPolicy(names: readonly string[], behavior: RuleBehavior, source: string, pathBases: PathRuleBases | undefined): ToolPolicy;
+ */
+/** `behavior` = 这张表的态度 —— 型直接是 core 的 `PermissionRule["behavior"]`(不手抄:core 加 / 减一种态度,这里与它同步、读者 tsc 上见到)。 */
+export declare function createRuleListPolicy(names: readonly string[], behavior: PermissionRule["behavior"], source: string, pathBases: PathRuleBases | undefined): ToolPolicy;
 //# sourceMappingURL=permission-rule-list.d.ts.map

package/dist/plugins/one-time-migrations.d.ts

@@ -24,6 +24,10 @@ export interface OneTimeMigrationReport {
     readonly sessionIncarnationsBackfilled: number;
     /** M6:本次给「只有句子」的死亡判决行补上机读码的 run 行数(SQL `task_run` / local `run.json`)。非零 = 这次迁移真写了存量行(与 M4 同一条纪律)。 */
     readonly holderDeathCodeRowsBackfilled: number;
+    /** M8:本次把 `checkpoint.risk_descriptor` 的旧披露键 `shadowedRule` 改写成 `allowRuleShadowed` 的行数(SQL 独有;local 恒 0)。非零 = 真写了存量行。 */
+    readonly allowRuleShadowRowsMigrated: number;
+    /** M8:带旧键字样、但这一格的 JSON 读不懂 ⇒ 没改写的行数(留给读口自己的响亮臂;非零 = 运维该看一眼这些行)。SQL 独有;local 恒 0。 */
+    readonly allowRuleShadowRowsUnreadable: number;
 }
 /**
  * S-590 —— 一条一次性迁移的窗(登记表的一行;纯数据)。字段注写着每个值的取证方式,改一行之前照着重核。
@@ -95,6 +99,22 @@ export declare class RetiredSteerSeatError extends Error {
  * @throws {RetiredSteerSeatError} M2 探到非空的退役席位(唯一的拒启臂)。
  */
 export declare function runSqlOneTimeMigrations(dialect: "tidb" | "pg", pool: MysqlPool | PgPool): Promise<OneTimeMigrationReport>;
+/** M8 一行改写的结论:改写后的文本 / 这一行不用动 / 读不懂(解析错误原样交出,调用方计数进读数)。 */
+export type ShadowedRuleRewrite = {
+    readonly kind: "rewrite";
+    readonly text: string;
+} | {
+    readonly kind: "untouched";
+} | {
+    readonly kind: "unreadable";
+    readonly error: unknown;
+};
+/**
+ * M8 的**一行**改写(纯函数;导出给钉用):`risk_descriptor` 的 JSON 文本里顶层带字符串 `shadowedRule` ⇒ 改写(旧键删、`allowRuleShadowed`
+ * 由旧值铸一条 `persisted` 记录;行上已经有 `allowRuleShadowed` ⇒ 只删旧键,不并);不是对象 / 没有旧键 / 旧键不是字符串 ⇒ `untouched`;
+ * JSON 读不懂 ⇒ `unreadable`(这一行不动,交给读口自己的响亮臂;迁移不替它猜,但把它数进读数,不静默)。
+ */
+export declare function migrateShadowedRuleDescriptor(text: string): ShadowedRuleRewrite;
 /**
  * M3 的**纯**改写(local 车道的账本行逐条走它;SQL 两腿在服务端用等价的 JSON 路径表达同一件事)。
  * 不改原对象(调用方与账本共享引用):有变更时换一只信封,原记录一个字节不动;无变更 ⇒ 返回

package/dist/plugins/one-time-migrations.js

@@ -1,6 +1,6 @@
 import { acquireEnsureSchemaLock, releaseEnsureSchemaLock } from "./tidb-pool.js";
 import { acquirePgEnsureSchemaLock, releasePgEnsureSchemaLock } from "./pg-pool.js";
-import { jsonColumnTextExpr } from "./sql-json-column.js";
+import { decodeJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readNonNullJsonValueColumn } from "./sql-json-column.js";
 import { SESSION_META_INCARNATION_COLUMN, mintSessionIncarnation } from "../session-incarnation.js";
 import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR } from "./store-contracts.js";
 export const ONE_TIME_MIGRATIONS = [
@@ -76,6 +76,29 @@ export const ONE_TIME_MIGRATIONS = [
             "丢掉的 steer 不再告诉用户;`GET /v1/runs/:id` 上 `errorCode` 缺席、只剩 `error` 句子",
         reportKeys: ["holderDeathCodeRowsBackfilled"],
     },
+    {
+        id: "M7",
+        introducedIn: "7.117.0",
+        releasedOn: "2026-10-06",
+        removableAfter: "2026-11-05",
+        removal: "删 `http/checkpoint-ctx.ts` 的读法记号判据与拒臂(`allowListReadingUnstated` / `allowListReadingEraOf` / `allowListReadingRefusal` / " +
+            "`PERMISSIONS_ALLOW_READINGS` / `ALLOW_LIST_READING_ERAS`、`buildCheckpointCtx` 里的记号写点)、`CheckpointCtx.permissionsAllowReading`、" +
+            "`resume-legs.ts` 两个判点与 `approval-sweeps.ts` 的跳过臂、随包排空判据 `permissions-allow-list`(两份 SQL + 本地脚本那一条)",
+        afterRemoval: "没有响亮臂:删码之后仍停驻、体里带非空 allow 的旧读法行(把 `APPROVAL_TERMINAL_BACKSTOP_MS` 调长的部署,或跳过了带本条的版本直接升的库)会被按" +
+            "当前读法静默重放(名单时代的行:名单外的工具放开;表态时代的行:普通问不再问)—— 升级前按 MIGRATION 7.117.0 节跑排空判据清零",
+        reportKeys: [],
+    },
+    {
+        id: "M8",
+        introducedIn: "7.117.0",
+        releasedOn: "2026-10-06",
+        removableAfter: "2026-11-05",
+        removal: "删 migrateOn 的 M8 步(`checkpoint.risk_descriptor` 的旧键扫描 + CAS 回写)与 `migrateShadowedRuleKey` / `migrateShadowedRuleDescriptor`;" +
+            "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `allowRuleShadowRowsMigrated` / `allowRuleShadowRowsUnreadable`",
+        afterRemoval: "没有响亮臂:删码之后仍带旧键的停驻行(跳过了带本条的版本直接升的库)在运维待批队列上只缺结构化披露 `allowRuleShadowed`;旧键的文本仍经脱敏叶表" +
+            "「认不得的键按内容脱敏」一条脱敏后原样显示,卡上 `message` 里引擎写好的那句话不受影响",
+        reportKeys: ["allowRuleShadowRowsMigrated", "allowRuleShadowRowsUnreadable"],
+    },
 ];
 export const NO_SQL_MIGRATIONS = {
     retiredSnapshotTable: "absent",
@@ -85,6 +108,8 @@ export const NO_SQL_MIGRATIONS = {
     auditDetailJsonNullRows: 0,
     sessionIncarnationColumn: "lazy-on-read",
     sessionIncarnationsBackfilled: 0,
+    allowRuleShadowRowsMigrated: 0,
+    allowRuleShadowRowsUnreadable: 0,
 };
 const RETIRED_SNAPSHOT_TABLE = "snapshot_manifest";
 const RETIRED_STEER_SEAT_COLUMN = "pending_steer";
@@ -224,6 +249,7 @@ async function migrateOn(db, dialect) {
         (await db.exec(dialect === "tidb"
             ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND (error = ? OR error LIKE ?)"
             : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND (error = $2 OR error LIKE $3)", [RUN_HOLDER_DEATH_CODES.orphaned, RUN_ORPHANED_ERROR, `${RUN_ORPHANED_ERROR} (%`]));
+    const { migrated: allowRuleShadowRowsMigrated, unreadable: allowRuleShadowRowsUnreadable } = await migrateShadowedRuleKey(db, dialect);
     let retiredSnapshotTable = "absent";
     let retiredSnapshotRows = 0;
     let retiredSteerSeatColumn = "absent";
@@ -256,9 +282,59 @@ async function migrateOn(db, dialect) {
     }
     return {
         retiredSnapshotTable, retiredSnapshotRows, retiredSteerSeatColumn, retiredSteerSeatStaleRows, askOriginRowsMigrated, auditDetailJsonNullRows,
-        sessionIncarnationColumn, sessionIncarnationsBackfilled, holderDeathCodeRowsBackfilled,
+        sessionIncarnationColumn, sessionIncarnationsBackfilled, holderDeathCodeRowsBackfilled, allowRuleShadowRowsMigrated, allowRuleShadowRowsUnreadable,
     };
 }
+const RETIRED_SHADOWED_RULE_KEY = "shadowedRule";
+export function migrateShadowedRuleDescriptor(text) {
+    let parsed;
+    try {
+        parsed = decodeJsonColumn(text, readNonNullJsonValueColumn, "checkpoint.risk_descriptor (M8 rewrite)");
+    }
+    catch (error) {
+        if (isJsonColumnBodyProblem(error))
+            return { kind: "unreadable", error };
+        throw error;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+        return { kind: "untouched" };
+    const { [RETIRED_SHADOWED_RULE_KEY]: old, ...rest } = parsed;
+    if (typeof old !== "string")
+        return { kind: "untouched" };
+    const next = Object.hasOwn(rest, "allowRuleShadowed") ? rest : { ...rest, allowRuleShadowed: [{ member: "persisted", entries: [old] }] };
+    return { kind: "rewrite", text: JSON.stringify(next) };
+}
+const SHADOWED_RULE_BATCH = 500;
+async function migrateShadowedRuleKey(db, dialect) {
+    const like = `%"${RETIRED_SHADOWED_RULE_KEY}"%`;
+    let migrated = 0;
+    let unreadable = 0;
+    let after = "";
+    for (;;) {
+        const rows = await db.rows(dialect === "tidb"
+            ? `SELECT token, ${jsonColumnText(dialect, "risk_descriptor")} FROM checkpoint WHERE ${jsonColumnTextExpr(dialect, "risk_descriptor")} LIKE ? AND token > ? ORDER BY token LIMIT ${SHADOWED_RULE_BATCH}`
+            : `SELECT token, ${jsonColumnText(dialect, "risk_descriptor")} FROM checkpoint WHERE ${jsonColumnTextExpr(dialect, "risk_descriptor")} LIKE $1 AND token > $2 ORDER BY token LIMIT ${SHADOWED_RULE_BATCH}`, [like, after]);
+        for (const r of rows) {
+            const token = String(r.token);
+            after = token;
+            const text = r.risk_descriptor;
+            if (typeof text !== "string")
+                continue;
+            const next = migrateShadowedRuleDescriptor(text);
+            if (next.kind === "unreadable") {
+                unreadable += 1;
+                continue;
+            }
+            if (next.kind === "untouched")
+                continue;
+            migrated += await db.exec(dialect === "tidb"
+                ? `UPDATE checkpoint SET risk_descriptor = ? WHERE token = ? AND ${jsonColumnTextExpr(dialect, "risk_descriptor")} = ?`
+                : `UPDATE checkpoint SET risk_descriptor = $1 WHERE token = $2 AND ${jsonColumnTextExpr(dialect, "risk_descriptor")} = $3`, [next.text, token, text]);
+        }
+        if (rows.length < SHADOWED_RULE_BATCH)
+            return { migrated, unreadable };
+    }
+}
 const INCARNATION_BACKFILL_BATCH = 500;
 async function migrateSessionIncarnations(db, dialect) {
     if (!(await tableExists(db, dialect, "session_meta")))
@@ -329,7 +405,7 @@ export function migrateRetiredAskOrigin(type, data) {
 }
 export function logOneTimeMigrations(log, backend, report) {
     const changed = report.retiredSnapshotTable === "dropped" || report.retiredSteerSeatColumn === "dropped" || report.askOriginRowsMigrated > 0 || report.auditDetailJsonNullRows > 0 ||
-        report.sessionIncarnationColumn === "added" || report.sessionIncarnationsBackfilled > 0 || report.holderDeathCodeRowsBackfilled > 0;
+        report.sessionIncarnationColumn === "added" || report.sessionIncarnationsBackfilled > 0 || report.holderDeathCodeRowsBackfilled > 0 || report.allowRuleShadowRowsMigrated > 0 || report.allowRuleShadowRowsUnreadable > 0;
     (changed ? log.warn : log.info).call(log, "one_time_migrations_applied", {
         backend,
         retiredSnapshotTable: report.retiredSnapshotTable,
@@ -341,13 +417,17 @@ export function logOneTimeMigrations(log, backend, report) {
         sessionIncarnationColumn: report.sessionIncarnationColumn,
         sessionIncarnationsBackfilled: report.sessionIncarnationsBackfilled,
         holderDeathCodeRowsBackfilled: report.holderDeathCodeRowsBackfilled,
+        allowRuleShadowRowsMigrated: report.allowRuleShadowRowsMigrated,
+        allowRuleShadowRowsUnreadable: report.allowRuleShadowRowsUnreadable,
         removableAfter: Object.fromEntries(ONE_TIME_MIGRATIONS.map((w) => [w.id, w.removableAfter])),
         note: "one-time persisted-data migrations (M1: retired whole-tree snapshot index table dropped; M2: retired single-seat " +
             "steering column dropped; M3: retired ask-origin spelling rewritten in place; M4: audit details written as the JSON " +
             "text `null` by an earlier version folded to a SQL NULL, so \"no detail\" has exactly one on-disk spelling; M5: the " +
             "session incarnation column added and every session row without one minted its own token; M6: run rows failed by a " +
             "holder-death verdict written by an earlier version with only the sentence got the machine-readable code run.stalled / " +
-            "run.orphaned). Each step " +
+            "run.orphaned; M7 writes nothing — it is the window of the refusal that keeps a suspended task whose stored allow list was written " +
+            "under an earlier reading from resuming under the current one; M8: parked rows' allow-layer disclosure written by an earlier engine " +
+            "under its old key shadowedRule rewritten to allowRuleShadowed). Each step " +
             "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
             "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
             "version that still carries a step at least once before upgrading past its deletion.",

package/dist/router/route-orchestration.d.ts

@@ -1,26 +1,5 @@
-/**
- * The A value router — cash out the S1 supervisor value verdict (sema-internal server/docs/S1-VALUE-VERDICT.md §6.3) into a per-task
- * orchestration decision: run a task as `single` / `supervisor` / `team`.
- *
- * The verdict, in one line: **competent tasks have SUP/TEAM dominated (pure overhead) ⇒ default single; the real
- * supervisor value is (a) DANGER backstop (SUP prevention gate-deny > TEAM fan-out which AMPLIFIES danger ×K) and
- * (b) STRUCTURAL view-gap (goal-keeping / ask-aggregation, universally useful).** So this router is CONSERVATIVE
- * by construction:
- *   - default **single** (escalation is never free — the verdict measured it as pure overhead on competent work);
- *   - escalate to **supervisor** ONLY on a positive (a)-danger or (b)-structural signal;
- *   - NEVER auto-select **team** (fan-out is dominated everywhere tested AND amplifies danger; team stays
- *     caller-explicit — a deliberate `council`/`debate`/`team` request, or the `/v1/leader` endpoint).
- *
- * 🔴 ALL signals are DETERMINISTIC (config / mounted tools / exec-env isolation / autonomy / delegation). There is
- * NO LLM "difficulty" judge in the routing decision — the verdict's measurement-integrity rule ([ref] §2.2.1):
- * an LLM judge is a GATE inside an arm, NEVER the routing metric (it would make the router un-auditable + gameable).
- *
- * Pure + unit-testable. The decision is VALIDATED empirically against the S1 harness (a ROUTER arm that runs the
- * router's chosen arm per trap; the objective hidden-test oracle confirms danger→SUP prevents + competent→single
- * is not-worse) BEFORE it is wired into the live task path — never ship an unvalidated router.
- */
-import { type TaskSpec } from "@sema-agent/core";
 import type { Autonomy } from "../runtime-governance.js";
+import type { GovernanceOverrides } from "../governance-overrides.js";
 export type OrchestrationMode = "single" | "supervisor" | "team";
 /** The DETERMINISTIC signals the routing decision reads (extracted by {@link deriveRoutingSignals} from the
  *  task's resolved config — no task-content LLM judgement). */
@@ -116,5 +95,5 @@ export declare function isIsolatedExecEnv(provider?: string, runtimeClass?: stri
  * ⚠️ 连带(产品面,如实):写工具的 ask 从此也是强制卡 ⇒ 用户的「本会话放行」不再退役 SUP 路由的写门(shell 那一问修前就退不掉)。
  * 不改路由判据本身(`routeServiceTask` 一字不动)。
  */
-export declare function supPostureOverrides(): Partial<TaskSpec>;
+export declare function supPostureOverrides(): GovernanceOverrides;
 //# sourceMappingURL=route-orchestration.d.ts.map