@sema-agent/server 7.116.1 → 7.117.0

package/dist/rule-entry-list.d.ts

@@ -0,0 +1,99 @@
+/**
+ * **规则条目表在本仓受理口的判** —— 一份,三张表同调(core 7.42.0 起「这个调用不用问」只有一个去处:引擎的 allow 层;条目的文法、匹配、
+ * auto 剔除、读成空的通告都归引擎,本仓不写第二套):
+ *  · 请求自带技能的 `allowedTools` / `disallowedTools`(顶层 `skills[]` 与子代 `agents[].skills[]` 两处受理口,`spec-fields.ts` / `http/admission.ts`);
+ *  · 请求的 `settings.permissions.allow`(整份原样投 `TaskSpec.allowedTools`,`task-settings.ts`);
+ *  · 运维的 `APPROVAL_GRANT`(整份投 `RunnerDeps.allowedTools`,`config.ts` 启动校验)。
+ *
+ * 本仓在这些表上只剩下面三道判加名字层一问(内容形、`*`、写路径形引擎怎么读就怎么算)。**名字层四张表同一只判官**(core `judgeRuleToolName`):请求的
+ * `settings.permissions.allow` 与 deny / ask 两桶经 `config.ts` `unmatchableToolNamesRefusal`,技能两只清单经 `spec-fields.ts` `skillToolListRefusal`,运维表经
+ * `config.ts` `approvalGrantRefusal` —— 三只包装调的都是本文件 {@link retiredRuleEntryOf}(退役名 / 短名 / 协议名;不问文法),句子一组。
+ *  ① **形**({@link ruleEntryListShapeOk}):字符串数组。引擎逐条迭代;一个裸字符串会被逐字符读成几条(deny 侧 = 意图静默落空)。
+ *     本谓词不带条数帽(引擎的 `screenAllowedToolsValue` 只判形);条数帽是另一只函数 {@link allowLayerEntryCountIssue}(`MAX_ALLOW_LAYER_ENTRIES`,
+ *     请求 allow 桶、技能两只清单、运维表四张表同一只、同一句)。
+ *  ④ **退役名 / 无协议前缀的短名**({@link retiredRuleEntryOf}):判官是 core 导出的 `judgeRuleToolName`(请求三桶、会话规则写口、准备阶段的名审计
+ *     同一只、同一份空名册)。引擎的 allow 层对这一族今天照编一个永不命中的名字、不通告 —— 7.116.0 的运维表对它拒启,本仓不许在同一张表上
+ *     由响亮变静默;翻转条件与 `config.ts` 的 `allow-layer` 消费者同一句(引擎对非现行名出通告之后退役)。
+ *  ② **协议名的对端段铸不出 / 缺段 / 对端段写通配**({@link unreachableRuleEntryOf}):判官是 `namespaced-rule-name.ts` 的那一只、取名口是
+ *     `ruleEntryToolName`(配置表与会话规则写口同读)。引擎今天对这一族照编、一条都不命中、不通告 —— 等引擎的判官自己给这个判词时整只退役。
+ *  ③ **引擎读成空的条目**({@link inertRuleEntriesOf},判据 = 引擎包根 `compileAllowList(entries, behavior).inert`,原因词是引擎的
+ *     `ALLOW_ENTRY_INERT_REASONS`):deny 侧(技能的 `disallowedTools`)⇒ 拒 —— 一条以为拒了其实什么也不拒的条目是安全轴上的静默放宽;
+ *     运维的 allow 表 ⇒ 拒启(运维自己的配置,写错了当场改)。**请求的 allow 侧不拒**:引擎在开跑时发
+ *     `permission.allowed_tool_not_granted`(受众 = 用户)—— 终端会把用户设置里的 allow 整份投过来,一条今天读成空的写法不能把整条请求打回。
+ */
+import { type AllowEntryInertReason, type RuleToolNameVerdict } from "@sema-agent/core";
+import { type UnreachableNamespacedRuleName } from "./namespaced-rule-name.js";
+export declare function presentRuleEntry(entry: string): string;
+/** ① 形:字符串数组(空串也是字符串 —— 引擎把它读成 `grammar` 并通告 / 拒,见 ③)。 */
+export declare const ruleEntryListShapeOk: (v: unknown) => v is readonly string[];
+/**
+ * ①b **条数上限** —— 引擎要逐条播种的条目表(allow 层的三个本仓成员:请求的 `settings.permissions.allow`、请求自带技能的两只清单、运维的
+ * `APPROVAL_GRANT`)**一只常量、一只函数**。理由是引擎的准备开销,不是本仓的语义判据:引擎每次准备都逐条播种这些表(`AllowEntryTable.seed`
+ * 与技能授予表的 `hold` 都对已有条目线性查重 ⇒ 整表平方级、同步执行;core 7.42.0 上 1 万条约 2 s、2 万条约 6 s,本仓亲测)。不设帽 = 一份
+ * 8 MiB 以内的请求体能把整个进程的事件循环卡住几十秒。与 deny / ask 两桶的帽(`permission-rule-list.ts` `MAX_PERMISSION_RULES_PER_LIST`,
+ * 编译口的整表帽)是两件事、两个名字,数字恰好相同。
+ * 翻转条件:上游把播种改成集合查重之后,按新的开销重估这个数(或整只退役)。
+ */
+export declare const MAX_ALLOW_LAYER_ENTRIES = 1000;
+/** 超帽的拒句(不截:截掉的尾项读起来像「在生效」)—— 句子的唯一铸点(请求 allow 桶的 wire 拒体按字段重铸也调它)。 */
+export declare function describeAllowLayerOverCap(field: string, count: number): string;
+/** 一张条目表超了 {@link MAX_ALLOW_LAYER_ENTRIES} ⇒ 拒句 + 机读两数;没超 ⇒ `undefined`。四张表同调这一只。 */
+export declare function allowLayerEntryCountIssue(field: string, list: readonly unknown[]): {
+    readonly message: string;
+    readonly count: number;
+    readonly cap: number;
+} | undefined;
+/** 一张表里第一条「协议名写得出、却永远匹配不到」的条目。 */
+export interface UnreachableRuleEntry {
+    readonly entry: string;
+    readonly verdict: UnreachableNamespacedRuleName;
+}
+/** ② 第一条够不着任何挂载工具的协议名条目(都够得着 ⇒ `undefined`)。纯字符串运算。 */
+export declare function unreachableRuleEntryOf(list: readonly string[]): UnreachableRuleEntry | undefined;
+/** ② 的句子(`<field> names "<entry>", which can never match a tool (…)`;后半与配置表 / 会话规则写口同一只)。 */
+export declare function describeUnreachableRuleEntry(field: string, u: UnreachableRuleEntry): string;
+/** ④ 一张表里第一条退役名 / 无协议前缀短名的条目(都现行 ⇒ `undefined`)。名册恒空:本仓不在退役名下挂自有工具(与 `config.ts` 同注)。 */
+export interface RetiredRuleEntry {
+    readonly entry: string;
+    readonly verdict: Exclude<RuleToolNameVerdict, {
+        kind: "current";
+    }>;
+}
+export declare function retiredRuleEntryOf(list: readonly string[]): RetiredRuleEntry | undefined;
+/** ④ 的句子:退役名给 core 的现役指引;短名枚举协议表前缀(与 `config.ts` 对请求三桶的说法同口径)。 */
+export declare function describeRetiredRuleEntry(field: string, r: RetiredRuleEntry): string;
+/** 一条引擎读成空的条目与引擎给的原因词。 */
+export interface InertRuleEntry {
+    readonly entry: string;
+    readonly reason: AllowEntryInertReason;
+}
+/** ③ 引擎按 `behavior` 读这张表时读成空的条目(引擎的整表读法:allow 表里的 `*` 让整表读成空;deny 表里的 `*` 只读空它自己)。 */
+export declare function inertRuleEntriesOf(list: readonly string[], behavior: "allow" | "deny"): readonly InertRuleEntry[];
+/**
+ * 原因词 → 「怎么写」(闭集穷举:引擎加一个原因词 ⇒ 编译红)。句子只说这一条为什么什么也不做、换成哪种写法;原因词本身原样带在句子里。
+ */
+export declare function inertRuleEntryGuidance(reason: AllowEntryInertReason): string;
+/** ③ 的句子(`<field> entry "<e>" reads as nothing (<reason>): <怎么写>`;多条用分号连)。 */
+export declare function describeInertRuleEntries(field: string, inert: readonly InertRuleEntry[]): string;
+/** 提交体里技能所在的层(命中句与排空读数点名用):顶层 `skills[]` / 子代 `agents[].skills[]`。 */
+export type SkillListLayer = "skills" | "agents.skills";
+/** 一份提交体里第一处「技能的拒侧清单里有引擎读成空的条目」:在哪一层、拒句是什么。 */
+export interface SkillDenyInertEntry {
+    readonly layer: SkillListLayer;
+    readonly message: string;
+}
+/**
+ * ③ 的拒侧在**提交体**上的判(顶层 `skills[]` 与子代 `agents[].skills[]` 两层;第一处命中即答)。
+ *
+ * 🔴 **调用点两处**:`resolveSpec`(`boot/resolve-spec.ts`,**拒点** —— 新提交与五条续跑腿都经过它,所以「新提交会被拒的体,续跑重放时同样拒」
+ * 是结构性的)与 `http/checkpoint-ctx.ts` `storedBodyReplayRefusal`(存量体重放前的**预判**,五个续跑问点同调 —— 含 SLA 拒扫的跳过臂与终态 steer
+ * 铸唤醒卡之前,这两处不经 `resolveSpec`)。提交腿 ⇒ 400 `request.field_invalid`;续跑腿 ⇒ 409 `resume_blocked_by_policy`(`blockedBy: request.field_invalid`,
+ * 句子同一句,铸点 `checkpoint-ctx.ts` `resumeBlockedByPolicyAnswer`),拒在认领之前,行 / 卡 / ctx 不动。
+ * 为什么续跑也要判:引擎 7.41 的规则解析先去首尾空白(`"Bash "` 是一条有效的拒),7.42 逐字读(同一条读成 `grammar`,什么也不拒)——
+ * 7.116.x 上停驻、体里带这种条目的行,不判就是升级后那条拒无声消失。随包排空判据 `skill-deny-inert`(`scripts/drain-check-local.mjs` 调本函数)。
+ * 判据就是引擎的读法(`compileAllowList(entries, "deny").inert`),本函数只负责走提交体的两层、给出句子与层。
+ * 翻转条件:引擎今天对读成空的拒侧条目只发通告、照常激活技能;上游已认改成 fail-closed(读不出的拒侧条目所守的那次激活不发生)。
+ * 那一版到货后,本仓这一处与引擎的拒是同一件事的两处 —— 届时重估是否退役本判(连同随包排空判据 `skill-deny-inert`)。
+ */
+export declare function skillDenyInertEntryOf(body: unknown): SkillDenyInertEntry | undefined;
+//# sourceMappingURL=rule-entry-list.d.ts.map

package/dist/rule-entry-list.js

@@ -0,0 +1,110 @@
+import { compileAllowList, judgeRuleToolName, PROTOCOL_TABLE } from "@sema-agent/core";
+import { describeUnreachableNamespacedRuleName, ruleEntryToolName, unreachableNamespacedRuleNameOf } from "./namespaced-rule-name.js";
+import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+const PRESENTED_ENTRY_MAX = 160;
+export function presentRuleEntry(entry) {
+    const clean = entry.replace(CONTROL_AND_BIDI_STRIP_RE, "");
+    return clean.length <= PRESENTED_ENTRY_MAX ? clean : `${clean.slice(0, PRESENTED_ENTRY_MAX)}…(${entry.length} chars)`;
+}
+export const ruleEntryListShapeOk = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+export const MAX_ALLOW_LAYER_ENTRIES = 1_000;
+export function describeAllowLayerOverCap(field, count) {
+    return (`${field} has ${count} entries — at most ${MAX_ALLOW_LAYER_ENTRIES} are accepted. Refused rather than truncated: a truncated list silently drops the entries past the cap. ` +
+        `Merge entries into broader ones (mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**)) or trim the list`);
+}
+export function allowLayerEntryCountIssue(field, list) {
+    if (list.length <= MAX_ALLOW_LAYER_ENTRIES)
+        return undefined;
+    return { message: describeAllowLayerOverCap(field, list.length), count: list.length, cap: MAX_ALLOW_LAYER_ENTRIES };
+}
+export function unreachableRuleEntryOf(list) {
+    for (const entry of list) {
+        const verdict = unreachableNamespacedRuleNameOf(ruleEntryToolName(entry));
+        if (verdict !== undefined)
+            return { entry, verdict };
+    }
+    return undefined;
+}
+export function describeUnreachableRuleEntry(field, u) {
+    return `${field} names "${presentRuleEntry(u.entry)}", which can never match a tool (${describeUnreachableNamespacedRuleName(u.verdict)})`;
+}
+export function retiredRuleEntryOf(list) {
+    for (const entry of list) {
+        const verdict = judgeRuleToolName(ruleEntryToolName(entry), new Set());
+        if (verdict.kind !== "current")
+            return { entry, verdict };
+    }
+    return undefined;
+}
+export function describeRetiredRuleEntry(field, r) {
+    const why = r.verdict.kind === "retired"
+        ? r.verdict.guidance
+        : `pre-prefix short form — the live name carries a protocol prefix: ${PROTOCOL_TABLE.map((e) => `${e.prefix}${presentRuleEntry(r.entry)}`).join(" or ")}`;
+    return `${field} names "${presentRuleEntry(r.entry)}", which can never match a tool (${why})`;
+}
+export function inertRuleEntriesOf(list, behavior) {
+    return compileAllowList(list, behavior).inert;
+}
+export function inertRuleEntryGuidance(reason) {
+    switch (reason) {
+        case "wildcard_all":
+            return "`*` names no tool (on an allow list it voids the whole list) — name the tools instead";
+        case "namespace_wildcard":
+            return "a server segment does not take a wildcard (`mcp__*`) — name the server: mcp__<server> or mcp__<server>__*";
+        case "path_pattern":
+            return "a write-path or file-pattern entry has no reading on this side — name the tool, or use Read(//<dir>/**) for a directory a Read may cover";
+        case "domain":
+            return "a domain entry has no reading on this side — name the tool";
+        case "content_unsupported":
+            return "this tool takes no content form here — name the tool itself, or use Bash(<command>) / Bash(<prefix>:*) for a shell command";
+        case "grammar":
+            return "the entry is not read as written (surrounding whitespace, an empty or unbalanced tool name) — write the tool name exactly, with no padding";
+        default: {
+            const unhandled = reason;
+            throw new Error(`unhandled allow-entry inert reason: ${String(unhandled)}`);
+        }
+    }
+}
+export function describeInertRuleEntries(field, inert) {
+    return inert.map((i) => `${field} entry "${presentRuleEntry(i.entry)}" reads as nothing (${i.reason}): ${inertRuleEntryGuidance(i.reason)}`).join("; ");
+}
+const isPlainRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+function skillDenyInertSentence(skill) {
+    if (!isPlainRecord(skill))
+        return undefined;
+    const deny = skill["disallowedTools"];
+    if (!ruleEntryListShapeOk(deny))
+        return undefined;
+    const inert = inertRuleEntriesOf(deny, "deny");
+    if (inert.length === 0)
+        return undefined;
+    return `${describeInertRuleEntries("skill.disallowedTools", inert)} — a deny entry that reads as nothing refuses nothing, so it is refused here rather than taken as in effect`;
+}
+export function skillDenyInertEntryOf(body) {
+    if (!isPlainRecord(body))
+        return undefined;
+    const skills = body["skills"];
+    if (Array.isArray(skills)) {
+        for (const skill of skills) {
+            const sentence = skillDenyInertSentence(skill);
+            if (sentence !== undefined)
+                return { layer: "skills", message: sentence };
+        }
+    }
+    const agents = body["agents"];
+    if (Array.isArray(agents)) {
+        for (let i = 0; i < agents.length; i++) {
+            const agent = agents[i];
+            const agentSkills = isPlainRecord(agent) ? agent["skills"] : undefined;
+            if (!Array.isArray(agentSkills))
+                continue;
+            for (let j = 0; j < agentSkills.length; j++) {
+                const sentence = skillDenyInertSentence(agentSkills[j]);
+                if (sentence !== undefined)
+                    return { layer: "agents.skills", message: `agents[${i}]: skills[${j}]: ${sentence}` };
+            }
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=rule-entry-list.js.map

package/dist/run-local.d.ts

@@ -132,7 +132,7 @@ export interface LocalApproverIo {
  * 🔴 S-694 起本席也服**三张审批名单**产的 ask(审批基线取 live 席,见 {@link RUN_LOCAL_APPROVAL_SEAT}):
  * `APPROVAL_REQUIRE` / `APPROVAL_NEVER_AUTO` 命中 ⇒ 策略 `ask` ⇒ 落到这里。`AskRequest` 不带是哪条声明产的
  * ask(core 把 `matchedAskRule` 刻意留在闸内、不上请求),但带这一问的**类**(`classes`,core 7.37.0 起)。
- * 🔴 无 TTY 拒句的出路**按这一问的类说话**({@link NO_TTY_ASK_CLASS_ROW} 一张闭集表:每类 ⇒ 一种出路):没人表态的服务器工具调用指 `APPROVAL_GRANT`,
+ * 🔴 无 TTY 拒句的出路**按这一问的类说话**({@link NO_TTY_ASK_CLASS_ROW} 一张闭集表:每类 ⇒ 一种出路):普通问与没人表态的服务器工具调用指 `APPROVAL_GRANT`(allow 层的部署成员清的就是这两类),
  * 写下的 ask 名单指名单旋钮(`APPROVAL_DENY` 也点名 —— 它当场拒、不经本席),部署强制要人答的问(`operator_forced`)列「one of」能铸它的来源、shell 地板(`shell_floor`)另一句只列铸它的旋钮,其余各类**不点任何旋钮**、只说去终端答;
  * 类缺席 ⇒ 说实话(「引擎没有说明这一问的类」),不回落成全量旋钮清单(那句对多数类是错的出路)。
  *
@@ -161,7 +161,9 @@ type NoTtyRemedy = NoTtySpokenRemedy | "terminal_only";
 /**
  * 一类问 ⇒ 这条腿上它的出路。**穷尽表**:core 的 `ASK_CLASSES` 加一类 ⇒ 这里 tsc 红(`Record<AskClass, …>` 少一键),新类必须在这里表态,
  * 不会悄悄落成「没有出路」。本仓知道而 core 不知道的只有一件:**哪只部署旋钮会产哪一类问**(逐类的产地见各行):
- *  · `unstated`:没有任何层表态的服务器工具调用(core 7.40.0)—— 运维为自己接的服务器表态的地方是 `APPROVAL_GRANT`(`run-local` 没有请求体,写不了 `settings.permissions.allow`);
+ *  · `unstated`:没有任何层表态的服务器工具调用(core 7.40.0)—— 运维写一次的地方是 `APPROVAL_GRANT`(`run-local` 没有请求体,写不了 `settings.permissions.allow`;
+ *    7.117.0 / core 7.42.0 起它是 allow 层的部署成员,经部署姿态座席族落在本腿的每只 Runner 上);
+ *  · `ordinary`:普通问(内置工具的写门、shell 的普通检查等)—— 7.117.0 起同样由 `APPROVAL_GRANT` 清(allow 层只清这两类),出路同上;
  *  · `ask_rule`:写下的 ask 规则 —— `APPROVAL_REQUIRE` / `APPROVAL_NEVER_AUTO`(`operatorAsk`)与治理层的 commandPolicy ask 名单(同一只铸点);请求体的
  *    `settings.permissions.ask` 到不了这条腿(本文件不 import 任何请求受理 / `task-settings`,`run-local` 的 spec 自铸);
  *  · `operator_forced`:部署**强制**要人答的问 —— 能铸它的来源(真 Runner × `applyLocalGovernance` 亲读类集,读数在 `test/run-local.test.ts` S-1100 ⑨ 各格):`APPROVAL_NEVER_AUTO`

package/dist/run-local.js

@@ -157,12 +157,12 @@ export const NO_TTY_ASK_CLASS_ROW = {
     artifact_shared_read: { remedy: "terminal_only", autoBudgetReleases: false },
     mode: { remedy: "terminal_only", autoBudgetReleases: false },
     unstated: { remedy: "grant", autoBudgetReleases: false },
-    ordinary: { remedy: "terminal_only", autoBudgetReleases: false },
+    ordinary: { remedy: "grant", autoBudgetReleases: false },
     requires_user_interaction: { remedy: "terminal_only", autoBudgetReleases: false },
 };
 const NO_TTY_REMEDY_SENTENCE = {
-    grant: () => `No rule, policy or hook granted this server tool and it states no permission of its own: the operator states one with APPROVAL_GRANT ` +
-        `(an allow rule for server tools — an exact tool name, mcp__<server>__* or a2a__<peer>__*).`,
+    grant: () => `Nothing on the allow layer covers this call: the operator can clear this kind of question once with APPROVAL_GRANT ` +
+        `(a tool name, mcp__<server>__* / a2a__<peer>__*, Bash(<prefix>:*), or Read(//<dir>/**)).`,
     approval_lists: (budget) => `The gate comes from the approval lists: APPROVAL_REQUIRE / APPROVAL_NEVER_AUTO (APPROVAL_DENY refuses outright without asking); ` +
         `a separate .env for this CLI keeps a server's lists off it.` +
         (budget ? ` APPROVAL_AUTO_BUDGET auto-approves that many APPROVAL_REQUIRE calls.` : ""),

package/dist/runs.js

@@ -82,6 +82,7 @@ const PREPARE_REFUSAL_HTTP_STATUS = {
     "config.invalid_checkpoint_store": 400,
     "config.skill_listing_budget_invalid": 400,
     "config.user_invoked_skill_unknown": 400,
+    "config.image_invalid": 400,
     "config.memory_capture_unsupported": 409,
 };
 export function resumeAtHttpStatus(result) {

package/dist/runtime-governance.d.ts

@@ -26,6 +26,7 @@
 import { type ShellGateDoctrine, type TaskSpec, type ToolPolicy } from "@sema-agent/core";
 import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
+import { type GovernanceOverrides } from "./governance-overrides.js";
 /** 运维 autonomy 四档的**闭集**(同上)。`config.ts` 的 `parseAutonomy` 也从这里读 —— 四档词表全仓一份。 */
 export declare const AUTONOMY_MODES: ["read-only", "ask", "plan", "auto"];
 /** A per-command governance rule (registry `runtime.commandPolicy[]`) —— **型也从契约派生**:
@@ -97,19 +98,6 @@ export declare function validateCommandRules(rules: CommandRule[]): string[];
  * 闭集本身则由契约 zod 派生 ⇒ 契约加一个判词,`RANK` 与桶分配的穷尽 switch 双双**编译红**。
  */
 export declare function compileCommandPolicyLayers(rules: CommandRule[] | undefined): ToolPolicy[];
-/** 运维 allow 规则表的出处名 = 它的 env 名(盖进每条规则;编不出来 / 不合文法时拒启句的主语)。 */
-export declare const APPROVAL_GRANT_SOURCE = "APPROVAL_GRANT";
-/**
- * 7.115.0 —— 运维的 allow 规则(`APPROVAL_GRANT`)编成治理层的**叶**(空 / 缺席 ⇒ `[]`,本层一片叶都不铸,折叠逐字与修前同)。
- *
- * 编译口是**请求腿 `settings.permissions.allow` 的同一只**(`permission-rule-list.ts` `createRuleListPolicy`,`behavior: "allow"`):命中 = core 带
- * `decisionReason: "rule"` 的放行(折叠把这句表态带到终局,引擎据此不再为没人表态的服务器工具调用出 `unstated` 卡);未命中 = 裸 allow =
- * 不表态。它是一片**不收紧**的叶 —— 与 commandPolicy / 守卫集同住一个折叠点,只因为三者是同一个「部署说的话」:折叠 deny > ask > allow,
- * 同折叠里任何一片叶的 deny / ask、`tightenTaskSpec` 之下的审批基线、之上的请求 settings 与会话规则,照旧压过它。
- *
- * 启动校验(`config.ts` `approvalGrantRefusal`)试编的也是本函数 —— 拒启判据与运行期编译是同一只,不会出现「启动收下、任务里编不出来」。
- */
-export declare function compileApprovalGrantLayers(grant: readonly string[] | undefined): ToolPolicy[];
 /**
  * Expand an autonomy mode into TIGHTEN-ONLY `TaskSpec` safety overrides (the primitives — TRAP #2):
  *  - `read-only` / `plan` → `handsReadOnly: true` **+ `writeFace: "roots"`** (read + propose, never mutate; the
@@ -133,7 +121,7 @@ export declare function compileApprovalGrantLayers(grant: readonly string[] | un
  * 与 `ask → shellGate:"always"` 同姿势:这一档**自己就是**一次「围栏在」的表态,所以无表态的请求上
  * 它照样把键写出来(不是「只在有 open 时才压」——那又是一条判据)。
  */
-export declare function autonomyOverrides(autonomy: Autonomy | undefined): Partial<TaskSpec>;
+export declare function autonomyOverrides(autonomy: Autonomy | undefined): GovernanceOverrides;
 /**
  * [ref]:**部署级**判据 —— 本部署的治理层自己是否把 shellGate 抬到 `"always"`。
  *
@@ -216,17 +204,15 @@ export declare function governanceOriginOf(gate: {
     };
 } | undefined, governance: GovernancePosture | undefined): true | undefined;
 /**
- * Apply the operator's runtime governance (autonomy + commandPolicy + manualModeShellGate + the guard set + the
- * `APPROVAL_GRANT` allow rules) onto a base
+ * Apply the operator's runtime governance (autonomy + commandPolicy + manualModeShellGate + the guard set) onto a base
  * `TaskSpec`, TIGHTEN-ONLY, in a SINGLE {@link tightenTaskSpec} call: commandPolicy compiles to a `toolPolicy`
  * override (combined onto the baseline by `tightenTaskSpec` — TRAP #1), and autonomy expands to
  * `handsReadOnly` / `shellGate` overrides (TRAP #2). `tightenTaskSpec` THROWS `TaskSpecTightenError` if any
  * override would LOOSEN a stricter base safety field — surfacing a misconfiguration loudly instead of silently
  * weakening the gate. Returns `base` untouched when there is nothing to apply.
  *
- * 7.115.0:`APPROVAL_GRANT` 是这里唯一一片**不收紧**的叶 —— 它只给出 allow 的那句表态(core 7.40.0 起没人表态的服务器工具调用要问,
- * 运维的规则就是那句答),从不清掉任何 deny / ask:折叠 deny > ask > allow,所以「部署 ⊇ 操作员 ⊇ 客户端只能收窄」的不变量逐字成立。
- * 编译口与请求腿的 allow 桶同一只({@link compileApprovalGrantLayers})。
+ * 7.117.0(core 7.42.0):运维的 allow 表 `APPROVAL_GRANT` 不再是这里的一片叶 —— 策略只说 deny / ask,allow 规则住在引擎 allow 层的部署席
+ * `RunnerDeps.allowedTools`(`boot/runner-deps.ts` 的部署姿态座席族,每只 Runner 同一席)。本函数因此只剩收紧。
  *
  * [ref]([ref] server 分单②):`MANUAL_MODE_SHELL_GATE` 从 settings 折叠搬到这里**无条件施加**。旧家
  * (task-settings deriveSettingsPolicy 的 default/auto/acceptEdits 三臂)让一个**部署级 tighten-only 旋钮
@@ -260,8 +246,6 @@ export declare function applyRuntimeGovernance(base: TaskSpec, governance: {
     /** 守卫集的**叶**(`deployment-governance.ts` `createDeploymentGovernanceInputs` 预铸;S-958 起是叶的列表,不是一只预折的策略)。
      *  空列表与缺席同义。 */
     sensitivePathLayers?: readonly ToolPolicy[];
-    /** 7.115.0:运维的 allow 规则(`APPROVAL_GRANT` 原串;本函数经 {@link compileApprovalGrantLayers} 编成叶)。空列表与缺席同义。 */
-    approvalGrant?: readonly string[];
     /** [ref]/[ref] `governanceForced` 的标记表(缺省 = **当前 run 腿的 ALS 表**,见
      *  `governance-ask-marks.ts` 顶注「作用域」段)。注入口只为测试与将来的多实例形。 */
     askMarks?: GovernanceAskMarks;

package/dist/runtime-governance.js

@@ -1,8 +1,8 @@
-import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, wrapToolPolicy, } from "@sema-agent/core";
+import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, wrapToolPolicy, } from "@sema-agent/core";
 import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
+import { tightenGoverned } from "./governance-overrides.js";
 import { createDeploymentAuthoredPolicy, operatorAsk } from "./operator-ask.js";
-import { createRuleListPolicy } from "./permission-rule-list.js";
 import { heldRuleName } from "./tool-rule-names.js";
 const COMMAND_RULE_SHAPE = GovernanceConfig.shape.commandPolicy.unwrap().element.shape;
 const COMMAND_DECISIONS = COMMAND_RULE_SHAPE.decision.options;
@@ -101,10 +101,6 @@ export function compileCommandPolicyLayers(rules) {
     }
     return policies;
 }
-export const APPROVAL_GRANT_SOURCE = "APPROVAL_GRANT";
-export function compileApprovalGrantLayers(grant) {
-    return grant !== undefined && grant.length > 0 ? [createRuleListPolicy(grant, "allow", APPROVAL_GRANT_SOURCE, undefined)] : [];
-}
 export function autonomyOverrides(autonomy) {
     switch (autonomy) {
         case "read-only":
@@ -148,7 +144,7 @@ function createGovernanceShellGateMarkPolicy(marksOf, tools = COARSE_SHELL_TOOLS
 export function applyRuntimeGovernance(base, governance) {
     const marksOf = () => governance.askMarks ?? currentGovernanceAskMarks();
     const overrides = { ...autonomyOverrides(governance.autonomy) };
-    const layers = [...compileCommandPolicyLayers(governance.commandPolicy), ...(governance.sensitivePathLayers ?? []), ...compileApprovalGrantLayers(governance.approvalGrant)];
+    const layers = [...compileCommandPolicyLayers(governance.commandPolicy), ...(governance.sensitivePathLayers ?? [])];
     const governancePolicy = layers.length > 0 ? createGovernanceAskMarkingPolicy(combinePolicies(...layers.map(createDeploymentAuthoredPolicy)), marksOf) : undefined;
     if (governancePolicy !== undefined)
         overrides.toolPolicy = governancePolicy;
@@ -161,6 +157,6 @@ export function applyRuntimeGovernance(base, governance) {
     if (Object.keys(overrides).length === 0) {
         return base;
     }
-    return tightenTaskSpec(base, overrides);
+    return tightenGoverned(base, overrides);
 }
 //# sourceMappingURL=runtime-governance.js.map

package/dist/spec-fields.d.ts

@@ -4,7 +4,6 @@
  * body WITHOUT the HTTP-layer 400 validation, so a malformed value must fall back to a safe default, never throw.
  */
 import { type AgentDefinition, type TaskSpec } from "@sema-agent/core";
-import { type UnreachableNamespacedRuleName } from "./namespaced-rule-name.js";
 /**
  * E12 — normalize `body.suggestNextPrompts` → `TaskSpec.suggestNextPrompts`. `true` = on with core defaults
  * (count 3, cheap role); an object tunes `count` (clamped 1..10) / `role` (a free string — core validates it against
@@ -48,31 +47,24 @@ export declare const MAX_TASK_AGENTS = 32;
  * deny 规则来源,不是围栏)的**形**谓词。两道技能门(顶层 `body.skills[]` 的 `validateUserSkills`、`agents[].skills[]` 的
  * {@link SKILL_FIELD_SHAPES})**同一只**:一边判一边不判 = 同一个键两种话(S-377 baseDir 吃过的亏)。
  *
- * 本谓词只判「字符串数组」:引擎 `compileSkillGrant` 直接 `for (const entry of list)` —— 一个裸字符串 `"Bash"` 会被逐字符迭代成
- * `B` / `a` / `s` / `h` 四条(deny 侧 = 意图静默落空,安全轴上的放宽方向)。条目的**文法**不在受理面判:引擎在开跑时对读不出的条目
- * (`*` / 写路径 / 域名)发 `skills.allowed_tool_not_granted`,文法的属主是引擎(directory loader 同样原样抄、不判)。
- * 形对之后两道门再问一问 {@link unreachableSkillToolListEntryOf}(协议名的服务器段铸不出 / 缺段 ⇒ 400)—— 那一问不是文法,是「写得出却永远匹配不到」,
- * 与配置表、会话规则写口同一只判官。
- * 无条数 / 长度帽([ref]:技能面的受理帽整族退役,体积由 8 MiB 请求体上限兜)。
+ * 本谓词只判「字符串数组」(core 7.42.0 起与请求的 `settings.permissions.allow`、运维的 `APPROVAL_GRANT` **同一只**:`rule-entry-list.ts` 的
+ * `ruleEntryListShapeOk`):引擎直接 `for (const entry of list)` —— 一个裸字符串 `"Bash"` 会被逐字符迭代成 `B` / `a` / `s` / `h` 四条
+ * (deny 侧 = 意图静默落空,安全轴上的放宽方向)。条目的**文法**归引擎:允侧读不出的条目(`*` / 写路径 / 域名)引擎在开跑时发
+ * `permission.allowed_tool_not_granted`(受众 = 用户);拒侧读成空的条目在 `resolveSpec` 拒(提交 400 / 续跑 409,`rule-entry-list.ts` 的
+ * `skillDenyInertEntryOf`,两处调用:提交口拒点 + 存量体重放预判)。形对之后两道门再问 {@link skillToolListRefusal}(协议名的服务器段铸不出 / 缺段 ⇒ 400)——
+ * 不是文法,是「写得出却永远不生效」,判据与请求的 allow 桶、运维的 allow 表同一份(`rule-entry-list.ts`)。
+ * 条数帽 = 条目表那一只(`rule-entry-list.ts` `allowLayerEntryCountIssue`,准备开销的界 —— 引擎逐条播种是平方级;与请求 allow 桶、运维表同一只),
+ * 在 {@link skillToolListRefusal} 里判;无长度帽([ref])。
  */
-export declare const skillToolListOk: (v: unknown) => boolean;
-/** 技能的两只清单(`allowedTools` = allow 规则来源,`disallowedTools` = deny 规则来源;条目的工具名那一段两只同读)。 */
-declare const SKILL_TOOL_LISTS: readonly ["allowedTools", "disallowedTools"];
-/** 技能清单里一条够不着任何挂载工具的协议名条目。 */
-export interface SkillToolListUnreachable {
-    readonly key: (typeof SKILL_TOOL_LISTS)[number];
-    readonly entry: string;
-    readonly verdict: UnreachableNamespacedRuleName;
-}
+export declare const skillToolListOk: (v: unknown) => v is readonly string[];
 /**
- * 一条技能(形已过两道门的字符串数组判)的两只清单里,第一条「协议名写得出、却永远匹配不到」的条目 —— 判官是 `namespaced-rule-name.ts` 那一只
- * (配置表 / 请求三桶 / 会话规则写口同调),条目的工具名那一段经同一只 `ruleEntryToolName` 取(与配置表的规则编译器消费者同读)。都够得着 ⇒ `undefined`。
- * 两处受理口同调:顶层 `skills[]`(`http/admission.ts` 的 `validateUserSkills`)、子代 `agents[].skills[]`({@link validateTaskAgents})。
- * 续跑重放**不问**这一问(两层都是:重放腿不过受理口,存量体照旧原样交给引擎 —— 引擎把它编成一条永不命中的规则,与修前同一种命运,不另开读法)。
+ * 一条技能(形已过两道门的字符串数组判)的两只清单在受理口的拒因 —— 都过 ⇒ `undefined`。两处受理口同调:顶层 `skills[]`
+ * (`http/admission.ts` 的 `validateUserSkills`)、子代 `agents[].skills[]`({@link validateTaskAgents})。判据是 `rule-entry-list.ts` 那一份:
+ * 任一只清单里「协议名写得出、却永远匹配不到」的条目(与请求的 allow 桶、配置表、会话规则写口同一只判官)。
+ * 拒侧读成空的条目**不在这里判**:那一问在 `resolveSpec`(`rule-entry-list.ts` 的 `skillDenyInertEntryOf`;新提交与每条续跑腿都经过那一处)与存量体重放前的
+ * 预判(`http/checkpoint-ctx.ts` `storedBodyReplayRefusal`)—— 一只判、两处调用。
  */
-export declare function unreachableSkillToolListEntryOf(skill: Record<string, unknown>): SkillToolListUnreachable | undefined;
-/** 两处受理口同一句(句子的后半与配置表 / 会话规则写口同一只 `describeUnreachableNamespacedRuleName`)。 */
-export declare function describeUnreachableSkillToolListEntry(u: SkillToolListUnreachable): string;
+export declare function skillToolListRefusal(skill: Record<string, unknown>): string | undefined;
 /** [ref] 单条 agent 定义的形状裁决:null=合法;否则一句可 400 的英文错误(不带索引,调用方自己加)。
  *  白名单外键 fail-loud —— 与 resilience/limits 的「容忍未知键」相反:agents 是能力定义,静默丢字段 =
  *  定义被悄悄削(一个丢掉的 isolation 就是放宽),比 400 更危险,故整条拒。⚠️ 已知残账(core 半场):
@@ -188,5 +180,4 @@ export declare function normalizeApproachNotice(raw: unknown): false | {
  * 全空 ⇒ undefined(spec 不挂 limits 键,byte-compat)。
  */
 export declare function resolveTaskLimits(bodyLimits: unknown, caps: TaskLimitCaps, envTimeoutSec: number, requirePrincipal: boolean | undefined, big: boolean, warn?: (event: string, fields: Record<string, unknown>) => void): TaskSpec["limits"];
-export {};
 //# sourceMappingURL=spec-fields.d.ts.map

package/dist/spec-fields.js

@@ -1,7 +1,7 @@
 import { isThinkingLevel } from "@sema-agent/core";
 import { taskWallClockSec } from "./task-workflow.js";
 import { isValidCwd } from "./task-cwd.js";
-import { describeUnreachableNamespacedRuleName, ruleEntryToolName, unreachableNamespacedRuleNameOf } from "./namespaced-rule-name.js";
+import { allowLayerEntryCountIssue, describeRetiredRuleEntry, describeUnreachableRuleEntry, retiredRuleEntryOf, ruleEntryListShapeOk, unreachableRuleEntryOf } from "./rule-entry-list.js";
 export function normalizeSuggestNextPrompts(v) {
     if (v === true)
         return true;
@@ -66,26 +66,25 @@ const toolList = (v) => Array.isArray(v) &&
     v.length <= MAX_AGENT_TOOLS &&
     v.every((x) => typeof x === "string" && x.length > 0 && x.length <= MAX_AGENT_TOOL_NAME_CHARS);
 const plainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-export const skillToolListOk = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+export const skillToolListOk = ruleEntryListShapeOk;
 const SKILL_TOOL_LISTS = ["allowedTools", "disallowedTools"];
-export function unreachableSkillToolListEntryOf(skill) {
+export function skillToolListRefusal(skill) {
     for (const key of SKILL_TOOL_LISTS) {
         const list = skill[key];
-        if (!Array.isArray(list))
+        if (!ruleEntryListShapeOk(list))
             continue;
-        for (const entry of list) {
-            if (typeof entry !== "string")
-                continue;
-            const verdict = unreachableNamespacedRuleNameOf(ruleEntryToolName(entry));
-            if (verdict !== undefined)
-                return { key, entry, verdict };
-        }
+        const over = allowLayerEntryCountIssue(`skill.${key}`, list);
+        if (over !== undefined)
+            return over.message;
+        const retired = retiredRuleEntryOf(list);
+        if (retired !== undefined)
+            return describeRetiredRuleEntry(`skill.${key}`, retired);
+        const unreachable = unreachableRuleEntryOf(list);
+        if (unreachable !== undefined)
+            return describeUnreachableRuleEntry(`skill.${key}`, unreachable);
     }
     return undefined;
 }
-export function describeUnreachableSkillToolListEntry(u) {
-    return `skill.${u.key} names "${u.entry}", which can never match a tool (${describeUnreachableNamespacedRuleName(u.verdict)})`;
-}
 const skillFilesOk = (v) => Array.isArray(v) &&
     v.every((f) => plainObject(f) && typeof f.path === "string" && f.path.length > 0 && typeof f.content === "string");
 const SKILL_FIELD_SHAPES = {
@@ -197,9 +196,9 @@ export function validateTaskAgents(v) {
         const skills = v[i].skills;
         if (Array.isArray(skills)) {
             for (let j = 0; j < skills.length; j++) {
-                const unreachable = unreachableSkillToolListEntryOf(skills[j]);
-                if (unreachable !== undefined)
-                    return `agents[${i}]: skills[${j}]: ${describeUnreachableSkillToolListEntry(unreachable)}`;
+                const refusal = skillToolListRefusal(skills[j]);
+                if (refusal !== undefined)
+                    return `agents[${i}]: skills[${j}]: ${refusal}`;
             }
         }
         const name = v[i].name;

package/dist/task-settings.d.ts

@@ -12,22 +12,21 @@
  * idempotent (the same tighten), so no special resume handling is needed (mirrors runtime-governance).
  *
  * 🔒 SECURITY INVARIANTS (SDK settings.ts §3.3) —— **scope: the `settings.permissions` channel this module projects, and only it**:
- *  - permissions are folded via `tightenTaskSpec` (deny-wins `combinePolicies`); it THROWS on any override that would
- *    LOOSEN a stricter base safety field. Through THIS channel the client can ADD denies/asks/handsReadOnly on top of the
- *    deployment + operator baseline, never widen it. Its `allow` rules (S-654 (c), 7.115.0) STATE an allow for the tools they name —
- *    the answer core 7.40.0 wants before it runs an MCP / A2A call nobody stated — and never override a deny or an ask
- *    from any layer (deny > ask > allow); a miss has no opinion. They release no ask a layer raises itself: on built-in
- *    tools the engine's own write gate and shell checks still ask (unlike the reference implementation's `permissions.allow`).
- *  - ⚠️ This is NOT a claim about the request as a whole. Since server 7.116.0 (core 7.41.0) a request-carried skill's
- *    `allowedTools` — activated by the model's approved `Skill` card, or named in `userInvokedSkills` — IS an accepted
- *    loosening on a different channel (`skills[]` → `TaskSpec.skills`, never through this module): for the rest of that run
- *    it releases the `unstated` / `ordinary` asks the engine itself raises (including the built-in write gate and the shell's
- *    ordinary asks; same predicate as a persisted allow rule), on hosted / multi-tenant deployments too — no deployment
- *    switch, by ruling. It still clears no deny / ask rule (request or operator), no governance / shell-floor /
- *    write-protection / plan-mode / probe / mandated ask, and opens no write containment. An operator who needs a person
- *    asked for a given tool regardless uses the per-tool knobs: `APPROVAL_REQUIRE` (an ask rule), `APPROVAL_NEVER_AUTO`
- *    (a person, mandated), `MANUAL_MODE_SHELL_GATE=always` (shell). Pinned on the real assembly:
- *    `test/skill-grant-operator-knobs.test.ts`.
+ *  - `deny` / `ask` are folded via `tightenTaskSpec` (deny-wins `combinePolicies`); it THROWS on any override that would
+ *    LOOSEN a stricter base safety field. Through those two buckets the client can only ADD denies / asks / handsReadOnly on
+ *    top of the deployment + operator baseline.
+ *  - `allow` (server 7.117.0, core 7.42.0) is NOT a policy: the list rides WHOLE and verbatim into `TaskSpec.allowedTools`,
+ *    the request member of the engine's ONE allow layer (beside a deployment's `RunnerDeps.allowedTools`, a person's stored
+ *    rows, an active skill's `allowed-tools` and a PreToolUse hook's `allow`), read under one predicate. It IS an accepted
+ *    loosening for this run: an entry clears the `unstated` / `ordinary` questions the engine raises for the calls it covers
+ *    (the built-in write gate and the shell's ordinary asks included), on hosted / multi-tenant deployments too — no
+ *    deployment switch, by ruling (the execution lane is the sandbox; the operator's tools are the per-tool knobs). It clears
+ *    no deny / ask rule (request or operator), no governance / shell-floor / write-protection / plan-mode / probe / mandated
+ *    ask and no PreToolUse hook's ask, and opens no write containment; an entry that matches and cannot clear is disclosed on
+ *    the card (`allowRuleShadowed`). An operator who needs a person asked for a given tool regardless uses the per-tool knobs:
+ *    `APPROVAL_REQUIRE` (an ask rule), `APPROVAL_NEVER_AUTO` (a person, mandated), `MANUAL_MODE_SHELL_GATE=always` (shell).
+ *    A request-carried skill's `allowedTools` is the same member's twin (same grammar, same predicate, same admission judge
+ *    `rule-entry-list.ts`). Pinned on the real assembly: `test/allow-layer-operator-knobs.test.ts`.
  *  - permissionMode(轴B #2 注释保鲜,1.254——[ref]/[ref] 后的真实现):`defaultMode` 收**五**模式
  *    (default | acceptEdits | plan | bypassPermissions | auto),bypass/auto 被 HONOR 为 gate-shape 选择
  *    ——但深层不变量未变:bypass=「不加 ask 门」,恒不越部署基线(tightenTaskSpec deny-wins,基线 deny/
@@ -265,8 +264,9 @@ export interface SettingsPermissionBucketIssue {
 }
 /**
  * 三桶的**唯一**判据(纯函数)。`perms` 不是对象 ⇒ 不判(那一形归「settings.permissions must be an object」那道门);桶缺席 / `null`
- * ⇒ 不判(与 `permissions: null` 的「容器缺席」同一约定)。逐桶按 {@link SETTINGS_PERMISSION_BUCKETS} 的序:不是数组 ⇒ `bad_entry`(无
- * `index`);超帽 ⇒ `over_cap`(先判,拒体有界);首个非串 / 空串项 ⇒ `bad_entry` + 它的下标。全合法 ⇒ `null`。
+ * ⇒ 不判(与 `permissions: null` 的「容器缺席」同一约定)。逐桶按 {@link SETTINGS_PERMISSION_BUCKETS} 的序、按该桶的条目规则:不是数组 ⇒ `bad_entry`
+ * (无 `index`);`rule_policy` 桶超帽 ⇒ `over_cap`(先判,拒体有界)、首个非串 / 空串项 ⇒ `bad_entry` + 它的下标;`allow_layer` 桶首个非串项 ⇒
+ * `bad_entry` + 它的下标(整表判据 = `ruleEntryListShapeOk`),超帽同样 `over_cap`(帽的理由不同,见段头)。全合法 ⇒ `null`。
  */
 export declare function settingsPermissionBucketIssue(perms: unknown): SettingsPermissionBucketIssue | null;
 /** 本 service 真正**消费**的 `settings` 顶层键 —— 闭集。每一个都有消费点: