@sema-agent/server 7.116.1 → 7.118.0

package/dist/plugins/web-search.d.ts

@@ -106,7 +106,7 @@ export interface WebSearchCapability {
 export declare function projectWebSearchCapability(provider: WebSearchProvider | undefined): WebSearchCapability;
 export interface WebSearchBackendConfig {
     readonly provider: WebSearchProvider;
-    /** API key (brave/tavily). From `WEB_SEARCH_API_KEY` — never reaches the model. */
+    /** API key (brave/tavily). From `WEB_SEARCH_API_KEY` — never reaches the model. Must be usable as an HTTP header value ({@link isHttpHeaderValue}); the judges refuse one that is not, and the brave / tavily legs refuse it again before fetch. */
     readonly apiKey?: string;
     /** SearXNG 实例特定查询参数(`engines=` / `language=` 等)——透传给 core adapter 的 `extraParams`。
      *  一键装 SearXNG 的向导用它把「选了哪些上游引擎」落到引擎侧。仅 searxng 腿消费。 */
@@ -136,6 +136,25 @@ export interface WebSearchBackend {
     search: WebSearchFn;
     maxResults: number;
 }
+/**
+ * 🔴 「这个串能不能当 HTTP 头值」的**唯一**判据 —— 受理面(请求腿 `settings.webSearch.apiKey`)、部署 env 腿
+ * (`WEB_SEARCH_API_KEY`)与后端腿(brave / tavily 交给 fetch 之前)**同问这一只**。
+ *
+ * ## 病
+ * `apiKey` 以前只判「是串」。带换行 / NUL / 其它控制字符 / U+00FF 以上字符的 key 两条载体都采纳,到 fetch 构造或发出请求头的那一刻运行时当场抛;
+ * 构造腿那一抛是 `Headers.append: "<整串 key>" is an invalid header value.` —— 凭据明文就在 message 里,经 WebSearch 工具失败卡进模型与转写面。
+ *
+ * ## 判据就是运行时的那条流水线,问的是 Node 自带的两只校验
+ * fetch 对一个头值做两步:① `Headers` 构造 —— 首尾 HTTP 空白(含 CR / LF)归一化剥掉,其余位置的 CR / LF / NUL 与 U+00FF 以上字符抛;
+ * ② 发送层(undici)对**归一化后的值**再过一遍字符表(HT、U+0020..U+007E、U+0080..U+00FF 可发;其余控制字符与 U+007F 抛 `invalid <name> header`)。
+ * 本判据逐步问同样两只:`new Headers(...)` 取归一化值,再交 `node:http` 的 `validateHeaderValue`(与发送层同一张字符表)。**不自写字符表**
+ * (第二份表迟早与运行时漂开);两步合起来与真 fetch 的对拍钉在 `test/web-search.test.ts`(本地受控端点,U+0000..U+017F 逐字符全扫)—— 运行时改了头值律,那一格先红。
+ * 只问 `Headers` 构造是不够的:它接受 U+0001 / U+007F,发送层拒绝(两步缺一步 ⇒ 判官收下、每次搜索必失败)。
+ * 镜像运行时的后果如实:首尾空白(含 CR / LF)归一化后不剩,所以 `"key\n"` 这种从密钥文件带出尾随换行的串**照收**、发出去的是剥后的值 ——
+ * 与 {@link judgeEndpoint} 对 `https://@host` 同一条姿势:不比运行时多拒。
+ * 抛出的错误对象在这里**当场丢弃**(构造腿那条的 message 就是那串明文),调用方拿到的只有布尔。
+ */
+export declare function isHttpHeaderValue(value: string): boolean;
 export declare function setWebSearchBadPayloadObserver(fn: ((provider: string) => void) | undefined): void;
 /**
  * Build the `WebSearchConfig` (a `search` fn + `maxResults`) for `assembleFullBodyTools({ webSearch })`. The API key

package/dist/plugins/web-search.js

@@ -1,3 +1,4 @@
+import { validateHeaderValue } from "node:http";
 import { createSearxngSearchBackend } from "@sema-agent/core";
 import { isHierarchicalUrl, redactSecrets } from "../trace/redact.js";
 export const WEB_SEARCH_PROVIDERS = ["brave", "tavily", "searxng"];
@@ -28,6 +29,34 @@ function withTimeout(signal, ms) {
 async function errorText(res) {
     return (await res.text().catch(() => "")).slice(0, 200);
 }
+export function isHttpHeaderValue(value) {
+    try {
+        const sent = new Headers([["x-probe", value]]).get("x-probe") ?? "";
+        validateHeaderValue("x-probe", sent);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const API_KEY_FORM = "must be usable as an HTTP header value (it contains a character an HTTP header cannot carry, such as a line break)";
+function apiKeyHeaderValue(provider, key) {
+    switch (provider) {
+        case "brave":
+        case "searxng":
+            return key;
+        case "tavily":
+            return `Bearer ${key}`;
+    }
+}
+function authHeaderValue(provider, cfg) {
+    if (!cfg.apiKey)
+        throw new Error(`WEB_SEARCH_API_KEY is required for the ${provider} provider`);
+    const value = apiKeyHeaderValue(provider, cfg.apiKey);
+    if (!isHttpHeaderValue(value))
+        throw new Error(`WEB_SEARCH_API_KEY ${API_KEY_FORM}`);
+    return value;
+}
 async function httpFailure(provider, res) {
     const body = await errorText(res);
     return new Error(`${provider} search failed: HTTP ${res.status}${body ? ` — ${body}` : ""}`);
@@ -61,20 +90,18 @@ function normalize(raw, pick, max, provider) {
     return out;
 }
 async function braveSearch(fetchImpl, cfg, query, max, signal) {
-    if (!cfg.apiKey)
-        throw new Error("WEB_SEARCH_API_KEY is required for the brave provider");
+    const token = authHeaderValue("brave", cfg);
     const url = new URL(cfg.endpoint || BRAVE_BASE);
     url.searchParams.set("q", query);
     url.searchParams.set("count", String(Math.min(20, max)));
-    const res = await fetchImpl(url, { headers: { Accept: "application/json", "X-Subscription-Token": cfg.apiKey }, signal });
+    const res = await fetchImpl(url, { headers: { Accept: "application/json", "X-Subscription-Token": token }, signal });
     if (!res.ok)
         throw await httpFailure("brave", res);
     const data = (await res.json());
     return normalize(data.web?.results, (r) => ({ title: r.title, url: r.url, snippet: r.description }), max, "brave");
 }
 async function tavilySearch(fetchImpl, cfg, query, max, signal, opts) {
-    if (!cfg.apiKey)
-        throw new Error("WEB_SEARCH_API_KEY is required for the tavily provider");
+    const authorization = authHeaderValue("tavily", cfg);
     const body = { query, max_results: Math.min(20, max) };
     if (opts?.allowedDomains?.length)
         body.include_domains = opts.allowedDomains.slice(0, 300);
@@ -82,7 +109,7 @@ async function tavilySearch(fetchImpl, cfg, query, max, signal, opts) {
         body.exclude_domains = opts.blockedDomains.slice(0, 150);
     const res = await fetchImpl(new URL(cfg.endpoint || TAVILY_BASE), {
         method: "POST",
-        headers: { "Content-Type": "application/json", Authorization: `Bearer ${cfg.apiKey}` },
+        headers: { "Content-Type": "application/json", Authorization: authorization },
         body: JSON.stringify(body),
         signal,
     });
@@ -153,12 +180,14 @@ export function shouldProbeWebSearchOnBoot(env = process.env) {
 const ABSENT = { ok: true };
 const valueOf = (j) => (j.ok ? j.value : undefined);
 const isBlank = (s) => s.trim() === "";
-function judgeText(raw) {
+function judgeApiKey(provider, raw) {
     if (raw === undefined || raw === null)
         return ABSENT;
     if (typeof raw !== "string")
         return { ok: false, issue: "must be a string" };
-    return isBlank(raw) ? ABSENT : { ok: true, value: raw };
+    if (isBlank(raw))
+        return ABSENT;
+    return isHttpHeaderValue(apiKeyHeaderValue(provider, raw)) ? { ok: true, value: raw } : { ok: false, issue: API_KEY_FORM };
 }
 const ENDPOINT_FORM = "must be an absolute URL with a scheme and a host, such as https://search.example.com (a bare host or host:port is not one)";
 const ENDPOINT_USERINFO = "must not carry userinfo (user or user:password before the host)";
@@ -254,7 +283,7 @@ export function webSearchConfigFromEnv(env = process.env) {
     if (provider === undefined)
         return undefined;
     return assembleBackendConfig(provider, {
-        apiKey: envValue("WEB_SEARCH_API_KEY", judgeText(env.WEB_SEARCH_API_KEY)),
+        apiKey: envValue("WEB_SEARCH_API_KEY", judgeApiKey(provider, env.WEB_SEARCH_API_KEY)),
         endpoint: envValue("WEB_SEARCH_ENDPOINT", judgeEndpoint(env.WEB_SEARCH_ENDPOINT)),
         searxngParams: envValue("WEB_SEARCH_SEARXNG_PARAMS", judgeSearxngParams(env.WEB_SEARCH_SEARXNG_PARAMS)),
         maxResults: envValue("WEB_SEARCH_MAX_RESULTS", judgeCount(envNumber(env.WEB_SEARCH_MAX_RESULTS))),
@@ -284,7 +313,7 @@ export function judgeRequestWebSearch(raw) {
     if (!provider.ok)
         return { kind: "malformed", issue: `settings.webSearch.provider ${provider.issue}` };
     const fields = {
-        apiKey: judgeText(s.apiKey),
+        apiKey: judgeApiKey(provider.value, s.apiKey),
         endpoint: judgeEndpoint(s.endpoint),
         searxngParams: judgeSearxngParams(s.searxngParams),
         maxResults: judgeCount(s.maxResults),

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -183,25 +183,26 @@ export declare class SqlWorkflowNotifyJournalStore implements WorkflowNotifyJour
 /**
  * S-185 车CM —— **workflow 出身 park 的有界 join 索引** SQL 双生(契约与纪律的唯一属主 =
  * {@link import("../orchestration/workflow-agent-session-index.js").WorkflowAgentSessionIndex} 的文件头,
- * 这里只记方言差)。行是 `WorkflowRun` 的派生投影,写者只有一个(Journaling 装饰器的写观察点)。
+ * 这里只记方言差)。行是 `WorkflowRun` 的派生投影(一行一枚指针),写者只有一个(Journaling 装饰器的写观察点);
+ * 收割在删 run 行的同一个方法里按同一张待删 id 表删它们的指针({@link SqlWorkflowRunStore.reap})。
  *
  * ── 方言差,保持显式 ──────────────────────────────────────────────────────────────────────────
  *   - `?` 占位 vs `$n`,且 `syncRun` 的删除腿在 PG 上要按 `params.length` 记位(与 `listByScope` 同因)。
  *   - 「删掉这条 run 里已不在 rows 里的旧行」:TiDB `session_id NOT IN (?,?,…)`(动态占位数)vs
  *     PG `session_id <> ALL($n::text[])`(数组绑定)—— 两边同一件事,语句结构不同(reap 的批删同先例)。
- *   - upsert:TiDB `REPLACE INTO`(整行替换)vs PG `INSERT … ON CONFLICT (session_id) DO UPDATE`。
+ *   - upsert(主键 `(session_id, run_id)`):TiDB `REPLACE INTO`(整行替换)vs PG `INSERT … ON CONFLICT (session_id, run_id) DO UPDATE`。
  *   - schema 属主同店内其余表:TiDB DDL 在 tidb-pool.ts,PG DDL 在 pg-pool.ts(店不建表)。
  *
- * 🔴 **写序**:先 upsert 再删。反过来(先删后 upsert)会在两条语句之间留出一个**索引行不存在**的窗口,
- * 而这期间进来的 `/decide` 会诚实 miss ⇒ 一次本可受理的批准被退回。先 upsert 的最坏形是窗口内多一条
- * 旧行(读口按 session_id 精确查,取 run 后还要逐字比对赎回键 ⇒ 多余的行只会 miss,不会错配)。
+ * 🔴 **写序**:先 upsert 再删。反过来(先删后 upsert)会在两条语句之间留出一个**指针不存在**的窗口,
+ * 而这期间进来的 `/decide` 会诚实 miss ⇒ 一次本可受理的批准被退回。先 upsert 的最坏形是窗口内多一枚
+ * 旧指针(判决从记录读 ⇒ 多读一条记录,不会错配)。
  */
 export declare class SqlWorkflowAgentSessionIndex implements WorkflowAgentSessionIndex {
     private readonly db;
     constructor(db: SqlDriver);
     private q;
     syncRun(runId: string, rows: readonly WorkflowAgentSessionRow[]): Promise<void>;
-    findByAgentSession(sessionId: string): Promise<WorkflowAgentSessionRow | null>;
+    listByAgentSession(sessionId: string): Promise<WorkflowAgentSessionRow[]>;
 }
 /** MySQL-protocol (TiDB) bindings — historical class names preserved; `onWarn` is an ADDITIVE optional 2nd
  *  ctor arg (existing 1-arg call sites are unaffected — see {@link SqlWorkflowRunStore}'s C5 trace channel). */

package/dist/plugins/workflow-run-store-sql.js

@@ -160,6 +160,7 @@ export class SqlWorkflowRunStore {
         if (doomed.length === 0)
             return 0;
         const res = await this.db.query(this.q(`DELETE FROM workflow_run WHERE scope = ? AND id IN (${doomed.map(() => "?").join(",")})`, "DELETE FROM workflow_run WHERE scope = $1 AND id = ANY($2::text[])"), this.db.dialect === "tidb" ? [scope, ...doomed] : [scope, doomed]);
+        await this.db.query(this.q(`DELETE FROM workflow_agent_session WHERE scope = ? AND run_id IN (${doomed.map(() => "?").join(",")})`, "DELETE FROM workflow_agent_session WHERE scope = $1 AND run_id = ANY($2::text[])"), this.db.dialect === "tidb" ? [scope, ...doomed] : [scope, doomed]);
         return res.affected;
     }
 }
@@ -311,7 +312,7 @@ export class SqlWorkflowAgentSessionIndex {
     async syncRun(runId, rows) {
         for (const r of rows) {
             await this.db.query(this.q("REPLACE INTO workflow_agent_session (session_id, run_id, agent_key, scope) VALUES (?,?,?,?)", `INSERT INTO workflow_agent_session (session_id, run_id, agent_key, scope) VALUES ($1,$2,$3,$4)
-             ON CONFLICT (session_id) DO UPDATE SET run_id = EXCLUDED.run_id, agent_key = EXCLUDED.agent_key, scope = EXCLUDED.scope`), [r.sessionId, r.runId, r.agentKey, r.scope]);
+             ON CONFLICT (session_id, run_id) DO UPDATE SET agent_key = EXCLUDED.agent_key, scope = EXCLUDED.scope`), [r.sessionId, r.runId, r.agentKey, r.scope]);
         }
         const keep = rows.map((r) => r.sessionId);
         if (this.db.dialect === "tidb") {
@@ -322,12 +323,9 @@ export class SqlWorkflowAgentSessionIndex {
             await this.db.query(`DELETE FROM workflow_agent_session WHERE run_id = $1${keep.length > 0 ? " AND session_id <> ALL($2::text[])" : ""}`, keep.length > 0 ? [runId, keep] : [runId]);
         }
     }
-    async findByAgentSession(sessionId) {
-        const { rows } = await this.db.query(this.q("SELECT session_id, run_id, agent_key, scope FROM workflow_agent_session WHERE session_id = ?", "SELECT session_id, run_id, agent_key, scope FROM workflow_agent_session WHERE session_id = $1"), [sessionId]);
-        const r = rows[0];
-        if (!r)
-            return null;
-        return { sessionId: String(r.session_id), runId: String(r.run_id), agentKey: String(r.agent_key), scope: String(r.scope) };
+    async listByAgentSession(sessionId) {
+        const { rows } = await this.db.query(this.q("SELECT session_id, run_id, agent_key, scope FROM workflow_agent_session WHERE session_id = ? ORDER BY run_id", "SELECT session_id, run_id, agent_key, scope FROM workflow_agent_session WHERE session_id = $1 ORDER BY run_id"), [sessionId]);
+        return rows.map((r) => ({ sessionId: String(r.session_id), runId: String(r.run_id), agentKey: String(r.agent_key), scope: String(r.scope) }));
     }
 }
 export class TiDBWorkflowRunStore extends SqlWorkflowRunStore {

package/dist/request-key-closure.js

@@ -19,7 +19,7 @@ export function keyClosureClause(names, label) {
 }
 const TASK_BODY_DECLARED_KEYS = [
     "a2aPeers", "acceptPartialRestore", "additionalDirectories", "additionalReadDirectories", "agents",
-    "appendSystemPrompt", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
+    "appendSystemPrompt", "approvalReach", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
     "compaction", "compactionModel", "council", "cwd", "debate", "deferTools", "deviceId", "disableSkills", "enableFork",
     "excludeAllTools", "excludeTools", "fileHistory",
     "finalVerification", "forwardSubagentEvents", "images", "inheritEnv", "interactiveTools", "jobId", "limits", "maxCostUsd",

package/dist/request-value-closure.d.ts

@@ -52,7 +52,7 @@ export declare const MEMORY_OFF_SPELLING_MESSAGE = "memory must be the string 'o
 export declare const FILE_HISTORY_OFF_SPELLING_MESSAGE = "fileHistory must be the string 'disabled' when present (the request-level declaration that this run records no file history \u2014 no backup of an edited file, and no file restore in the same request; absent = the deployment's setting \u2014 there is no 'enabled' spelling)";
 /**
  * S-724 b′(主会话裁,车PW codex r1 [high] 复现后)—— `fileHistory: "disabled"` 与还原**同体**的拒句(`request.field_conflict`)。
- * 与 `tool-approval.ts` 的 `SETTLED_BY_DENY_ONLY` / `READ_ROOT_GRANT_ALLOW_ONLY` **同一族**:「只看体就能判的矛盾,在裁决之前响亮说」。
+ * 与 `tool-approval.ts` 的 `READ_ROOT_GRANT_ALLOW_ONLY` **同一族**:「只看体就能判的矛盾,在裁决之前响亮说」。
  * 这一对是调用方自己写出的矛盾(关掉这条 run 的文件历史,又要从文件历史还原);core 也拒(`rewind.capture_disabled`)。立门时(7.104.0)
  * core 的拒落在 prepare 的**会话分叉之后**(`prepare-acquire-reconcile` 先按 `resumeAt` 把活动分支移过去,`prepare-file-history` 才判),
  * 且拒后不回滚 —— 所以本层在任何副作用之前拒。**这不是替 core 再判一次「捕获关了能不能还原」**:判的是体里两个键

package/dist/router/route-orchestration.d.ts

@@ -1,26 +1,5 @@
-/**
- * The A value router — cash out the S1 supervisor value verdict (sema-internal server/docs/S1-VALUE-VERDICT.md §6.3) into a per-task
- * orchestration decision: run a task as `single` / `supervisor` / `team`.
- *
- * The verdict, in one line: **competent tasks have SUP/TEAM dominated (pure overhead) ⇒ default single; the real
- * supervisor value is (a) DANGER backstop (SUP prevention gate-deny > TEAM fan-out which AMPLIFIES danger ×K) and
- * (b) STRUCTURAL view-gap (goal-keeping / ask-aggregation, universally useful).** So this router is CONSERVATIVE
- * by construction:
- *   - default **single** (escalation is never free — the verdict measured it as pure overhead on competent work);
- *   - escalate to **supervisor** ONLY on a positive (a)-danger or (b)-structural signal;
- *   - NEVER auto-select **team** (fan-out is dominated everywhere tested AND amplifies danger; team stays
- *     caller-explicit — a deliberate `council`/`debate`/`team` request, or the `/v1/leader` endpoint).
- *
- * 🔴 ALL signals are DETERMINISTIC (config / mounted tools / exec-env isolation / autonomy / delegation). There is
- * NO LLM "difficulty" judge in the routing decision — the verdict's measurement-integrity rule ([ref] §2.2.1):
- * an LLM judge is a GATE inside an arm, NEVER the routing metric (it would make the router un-auditable + gameable).
- *
- * Pure + unit-testable. The decision is VALIDATED empirically against the S1 harness (a ROUTER arm that runs the
- * router's chosen arm per trap; the objective hidden-test oracle confirms danger→SUP prevents + competent→single
- * is not-worse) BEFORE it is wired into the live task path — never ship an unvalidated router.
- */
-import { type TaskSpec } from "@sema-agent/core";
 import type { Autonomy } from "../runtime-governance.js";
+import type { GovernanceOverrides } from "../governance-overrides.js";
 export type OrchestrationMode = "single" | "supervisor" | "team";
 /** The DETERMINISTIC signals the routing decision reads (extracted by {@link deriveRoutingSignals} from the
  *  task's resolved config — no task-content LLM judgement). */
@@ -116,5 +95,5 @@ export declare function isIsolatedExecEnv(provider?: string, runtimeClass?: stri
  * ⚠️ 连带(产品面,如实):写工具的 ask 从此也是强制卡 ⇒ 用户的「本会话放行」不再退役 SUP 路由的写门(shell 那一问修前就退不掉)。
  * 不改路由判据本身(`routeServiceTask` 一字不动)。
  */
-export declare function supPostureOverrides(): Partial<TaskSpec>;
+export declare function supPostureOverrides(): GovernanceOverrides;
 //# sourceMappingURL=route-orchestration.d.ts.map

package/dist/rule-entry-list.d.ts

@@ -0,0 +1,88 @@
+/**
+ * **规则条目表在本仓受理口的判** —— 一份,四张表同调(core 7.42.0 起「这个调用不用问」只有一个去处:引擎的 allow 层;条目的文法、匹配、
+ * 名字、读成空的通告都归引擎,本仓不写第二套):
+ *  · 请求自带技能的 `allowedTools` / `disallowedTools`(顶层 `skills[]` 与子代 `agents[].skills[]` 两处受理口,`spec-fields.ts` / `http/admission.ts`);
+ *  · 请求的 `settings.permissions.allow`(整份原样投 `TaskSpec.allowedTools`,`task-settings.ts`);
+ *  · 运维的 `APPROVAL_GRANT`(整份投 `RunnerDeps.allowedTools`,`config.ts` 启动校验)。
+ *
+ * 本仓在这些表上只剩下面几问(内容形、`*`、写路径形、名字引擎怎么读就怎么算):
+ *  ① **形**({@link ruleEntryListShapeOk}):字符串数组。引擎逐条迭代;一个裸字符串会被逐字符读成几条(deny 侧 = 意图静默落空)。
+ *     本谓词不带条数帽(引擎的 `screenAllowedToolsValue` 只判形);条数帽是另一只函数 {@link allowLayerEntryCountIssue}(`MAX_ALLOW_LAYER_ENTRIES`,
+ *     请求 allow 桶、技能两只清单、运维表四张表同一只、同一句)。
+ *  ② **引擎读不到的一形**({@link emptyToolSegmentEntryOf}):工具段为空的协议名(`mcp__srv__`)—— 引擎的判官答 `current`、条目读成一条精确名行、永不命中;
+ *     判据与句子在 `namespaced-rule-name.ts`(配置表、会话规则写口同一只)。四张表都拒。
+ *  ③ **引擎读成空的条目**({@link inertRuleEntriesOf},判据 = 引擎包根 `compileAllowList(entries, behavior, 名册)`,名册 = 空集 `NO_DECLARED_TOOL_NAMES`
+ *     —— 条目的工具名也过引擎判官:退役名 / 无前缀短名 / 对端段铸不出读成 `tool_name`,带判词与 1:1 现名;原因词是引擎的 `ALLOW_ENTRY_INERT_REASONS`):
+ *     运维的 allow 表拒启(运维自己的配置,写错了当场改);技能的拒侧(`disallowedTools`)拒 —— 提交 400、存量体重放 409(下面的 {@link skillDenyInertEntryOf});
+ *     请求的 allow 侧(`settings.permissions.allow`、技能 `allowedTools`)不拒:引擎在开跑时发 `permission.allowed_tool_not_granted`(受众 = 用户)。
+ *     技能拒侧那一拒与引擎 #1372(core 7.43.0:那只技能不激活)是同一件事的两处 —— 7.118.0 重估过、本版**不退**:本仓的续跑腿把引擎的
+ *     `checkpoint.config_refused`(`config.skill_deny_unreadable`)答得不一(资源停车续跑腿 500、`/decide` 先结了卡、`/wake` 先铸了 run 行),先统一那一层再退
+ *     (重估读数与退役条件在下面那只函数头注)。
+ */
+import { compileAllowList } from "@sema-agent/core";
+import { emptyToolSegmentOf } from "./namespaced-rule-name.js";
+export declare function presentRuleEntry(entry: string): string;
+/** ① 形:字符串数组(空串也是字符串 —— 引擎把它读成 `grammar` 并通告 / 拒,见 ③)。 */
+export declare const ruleEntryListShapeOk: (v: unknown) => v is readonly string[];
+/**
+ * ①b **条数上限** —— 引擎要逐条播种的条目表(allow 层的三个本仓成员:请求的 `settings.permissions.allow`、请求自带技能的两只清单、运维的
+ * `APPROVAL_GRANT`)**一只常量、一只函数**。理由是引擎的准备开销,不是本仓的语义判据:引擎每次准备都逐条播种这些表(`AllowEntryTable.seed`
+ * 与技能授予表的 `hold` 都对已有条目线性查重 ⇒ 整表平方级、同步执行;core 7.42.0 上 1 万条约 2 s、2 万条约 6 s,本仓亲测)。不设帽 = 一份
+ * 8 MiB 以内的请求体能把整个进程的事件循环卡住几十秒。与 deny / ask 两桶的帽(`permission-rule-list.ts` `MAX_PERMISSION_RULES_PER_LIST`,
+ * 编译口的整表帽)是两件事、两个名字,数字恰好相同。
+ * 7.118.0 重估(core 7.43.0 #1370 把播种改成集合查重,本仓同一只探针亲测 `AllowEntryTable.seed`:7.42.1 上 1 千条 127 ms、1 万条 4.9 s;7.44.0 上 1 千条 8 ms、
+ * 1 万条 160 ms、2 万条 226 ms、10 万条 1.08 s —— 线性了,但仍是同步工作,8 MiB 的体装得下几十万条)⇒ 帽留着、数不动:理由由「平方级」换成「线性但同步、
+ * 没有真实用法需要上千条」。抬不抬这个数是产品判断,不随提货改。
+ */
+export declare const MAX_ALLOW_LAYER_ENTRIES = 1000;
+/** 超帽的拒句(不截:截掉的尾项读起来像「在生效」)—— 句子的唯一铸点(请求 allow 桶的 wire 拒体按字段重铸也调它)。 */
+export declare function describeAllowLayerOverCap(field: string, count: number): string;
+/** 一张条目表超了 {@link MAX_ALLOW_LAYER_ENTRIES} ⇒ 拒句 + 机读两数;没超 ⇒ `undefined`。四张表同调这一只。 */
+export declare function allowLayerEntryCountIssue(field: string, list: readonly unknown[]): {
+    readonly message: string;
+    readonly count: number;
+    readonly cap: number;
+} | undefined;
+/** 一张表里第一条「引擎读不到、却永远匹配不到」的条目(工具段为空的协议名)。 */
+export interface EmptyToolSegmentEntry {
+    readonly entry: string;
+    readonly ns: NonNullable<ReturnType<typeof emptyToolSegmentOf>>;
+}
+/** ② 第一条工具段为空的协议名条目(没有 ⇒ `undefined`)。纯字符串运算。 */
+export declare function emptyToolSegmentEntryOf(list: readonly string[]): EmptyToolSegmentEntry | undefined;
+/** ② 的句子(`<field> names "<entry>", which can never match a tool (…)`;后半与配置表 / 会话规则写口同一只)。 */
+export declare function describeEmptyToolSegmentEntry(field: string, u: EmptyToolSegmentEntry): string;
+/** 一条引擎读成空的条目(引擎的形:原因词,名字层另带判词 / 1:1 现名;包根不导出这只具名型 ⇒ 从 `compileAllowList` 的返回型取,不手抄)。 */
+export type InertRuleEntry = ReturnType<typeof compileAllowList>["inert"][number];
+/** ③ 引擎按 `behavior` 读这张表时读成空的条目(引擎的整表读法:allow 表里的 `*` 让整表读成空;deny 表里的 `*` 只读空它自己);条目名过引擎判官(名册 = 空集)。 */
+export declare function inertRuleEntriesOf(list: readonly string[], behavior: "allow" | "deny"): readonly InertRuleEntry[];
+/**
+ * 原因词 → 「怎么写」(闭集穷举:引擎加一个原因词 ⇒ 编译红)。句子只说这一条为什么什么也不做、换成哪种写法;原因词本身原样带在句子里。
+ * 名字层两词带引擎给的判词 / 1:1 现名(有就点名)。
+ */
+export declare function inertRuleEntryGuidance(i: InertRuleEntry): string;
+/** ③ 的句子(`<field> entry "<e>" reads as nothing (<reason>): <怎么写>`;多条用分号连)。 */
+export declare function describeInertRuleEntries(field: string, inert: readonly InertRuleEntry[]): string;
+/** 提交体里技能所在的层(命中句与排空读数点名用):顶层 `skills[]` / 子代 `agents[].skills[]`。 */
+export type SkillListLayer = "skills" | "agents.skills";
+/** 一份提交体里第一处「技能的拒侧清单里有引擎读成空的条目」:在哪一层、拒句是什么。 */
+export interface SkillDenyInertEntry {
+    readonly layer: SkillListLayer;
+    readonly message: string;
+}
+/**
+ * ③ 的拒侧在**提交体**上的判(顶层 `skills[]` 与子代 `agents[].skills[]` 两层;第一处命中即答)。
+ *
+ * 🔴 **调用点两处**:`resolveSpec`(`boot/resolve-spec.ts`,**拒点** —— 新提交与五条续跑腿都经过它,所以「新提交会被拒的体,续跑重放时同样拒」
+ * 是结构性的)与 `http/checkpoint-ctx.ts` `storedBodyReplayRefusal`(存量体重放前的**预判**,五个续跑问点同调 —— 含 SLA 拒扫的跳过臂与终态 steer
+ * 铸唤醒卡之前,这两处不经 `resolveSpec`)。提交腿 ⇒ 400 `request.field_invalid`;续跑腿 ⇒ 409 `resume_blocked_by_policy`(`blockedBy: request.field_invalid`,
+ * 句子同一句,铸点 `checkpoint-ctx.ts` `resumeBlockedByPolicyAnswer`),拒在认领之前,行 / 卡 / ctx 不动。随包排空判据 `skill-deny-inert`
+ * (`scripts/drain-check-local.mjs` 调本函数)。判据就是引擎的读法(`compileAllowList(entries, "deny", 名册 = 空集)`,与 {@link inertRuleEntriesOf} 同一只;
+ * 7.118.0 起条目名也过引擎判官,退役名 / 对端段铸不出读成 `tool_name` —— 技能清单的名字层在受理口不再另判)。
+ * 7.118.0 重估(core 7.43.0 #1372 到货:读成空的拒侧条目让那只技能不激活)—— **本版不退**。实测(本判退掉之后跑同一批夹具):引擎的拒到本仓各续跑腿的
+ * 答法不一 —— 资源停车续跑腿把 `checkpoint.config_refused` 答成 500 `internal.error`;工具审批 `/decide` 在引擎拒之前已把卡结掉;`/wake` 在引擎拒之前已铸
+ * run 行;子代 `agents[].skills[]` 不在引擎的认领前屏里(续跑放行、技能在调用时被拒)。退役条件:本仓续跑腿对引擎 `checkpoint.config_refused` 的答法
+ * 收成一只(拒在认领前、行 / 卡不动、同一个 409)之后,本判与本仓的预判一起退,排空判据随之重估。
+ */
+export declare function skillDenyInertEntryOf(body: unknown): SkillDenyInertEntry | undefined;
+//# sourceMappingURL=rule-entry-list.d.ts.map

package/dist/rule-entry-list.js

@@ -0,0 +1,102 @@
+import { compileAllowList } from "@sema-agent/core";
+import { describeEmptyToolSegment, emptyToolSegmentOf, NO_DECLARED_TOOL_NAMES, ruleEntryToolName } from "./namespaced-rule-name.js";
+import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+const PRESENTED_ENTRY_MAX = 160;
+export function presentRuleEntry(entry) {
+    const clean = entry.replace(CONTROL_AND_BIDI_STRIP_RE, "");
+    return clean.length <= PRESENTED_ENTRY_MAX ? clean : `${clean.slice(0, PRESENTED_ENTRY_MAX)}…(${entry.length} chars)`;
+}
+export const ruleEntryListShapeOk = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+export const MAX_ALLOW_LAYER_ENTRIES = 1_000;
+export function describeAllowLayerOverCap(field, count) {
+    return (`${field} has ${count} entries — at most ${MAX_ALLOW_LAYER_ENTRIES} are accepted. Refused rather than truncated: a truncated list silently drops the entries past the cap. ` +
+        `Merge entries into broader ones (mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**)) or trim the list`);
+}
+export function allowLayerEntryCountIssue(field, list) {
+    if (list.length <= MAX_ALLOW_LAYER_ENTRIES)
+        return undefined;
+    return { message: describeAllowLayerOverCap(field, list.length), count: list.length, cap: MAX_ALLOW_LAYER_ENTRIES };
+}
+export function emptyToolSegmentEntryOf(list) {
+    for (const entry of list) {
+        const ns = emptyToolSegmentOf(ruleEntryToolName(entry));
+        if (ns !== undefined)
+            return { entry, ns };
+    }
+    return undefined;
+}
+export function describeEmptyToolSegmentEntry(field, u) {
+    return `${field} names "${presentRuleEntry(u.entry)}", which can never match a tool (${describeEmptyToolSegment(u.ns)})`;
+}
+export function inertRuleEntriesOf(list, behavior) {
+    return compileAllowList(list, behavior, NO_DECLARED_TOOL_NAMES).inert;
+}
+export function inertRuleEntryGuidance(i) {
+    const reason = i.reason;
+    const write = i.currentName !== undefined ? ` — write "${presentRuleEntry(i.currentName)}"` : "";
+    switch (reason) {
+        case "tool_name":
+            return `the tool name can never match a mounted tool (${i.verdict ?? "stale"})${write}`;
+        case "near_miss":
+            return `the tool name differs from a mounted tool only by case${write}`;
+        case "wildcard_all":
+            return "`*` names no tool (on an allow list it voids the whole list) — name the tools instead";
+        case "namespace_wildcard":
+            return "a server segment does not take a wildcard (`mcp__*`) — name the server: mcp__<server> or mcp__<server>__*";
+        case "path_pattern":
+            return "a write-path or file-pattern entry has no reading on this side — name the tool, or use Read(//<dir>/**) for a directory a Read may cover";
+        case "domain":
+            return "a domain entry has no reading on this side — name the tool";
+        case "content_unsupported":
+            return "this tool takes no content form here — name the tool itself, or use Bash(<command>) / Bash(<prefix>:*) for a shell command";
+        case "grammar":
+            return "the entry is not read as written (surrounding whitespace, an empty or unbalanced tool name) — write the tool name exactly, with no padding";
+        default: {
+            const unhandled = reason;
+            throw new Error(`unhandled allow-entry inert reason: ${String(unhandled)}`);
+        }
+    }
+}
+export function describeInertRuleEntries(field, inert) {
+    return inert.map((i) => `${field} entry "${presentRuleEntry(i.entry)}" reads as nothing (${i.reason}): ${inertRuleEntryGuidance(i)}`).join("; ");
+}
+const isPlainRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+function skillDenyInertSentence(skill) {
+    if (!isPlainRecord(skill))
+        return undefined;
+    const deny = skill["disallowedTools"];
+    if (!ruleEntryListShapeOk(deny))
+        return undefined;
+    const inert = inertRuleEntriesOf(deny, "deny");
+    if (inert.length === 0)
+        return undefined;
+    return `${describeInertRuleEntries("skill.disallowedTools", inert)} — a deny entry that reads as nothing refuses nothing, so it is refused here rather than taken as in effect`;
+}
+export function skillDenyInertEntryOf(body) {
+    if (!isPlainRecord(body))
+        return undefined;
+    const skills = body["skills"];
+    if (Array.isArray(skills)) {
+        for (const skill of skills) {
+            const sentence = skillDenyInertSentence(skill);
+            if (sentence !== undefined)
+                return { layer: "skills", message: sentence };
+        }
+    }
+    const agents = body["agents"];
+    if (Array.isArray(agents)) {
+        for (let i = 0; i < agents.length; i++) {
+            const agent = agents[i];
+            const agentSkills = isPlainRecord(agent) ? agent["skills"] : undefined;
+            if (!Array.isArray(agentSkills))
+                continue;
+            for (let j = 0; j < agentSkills.length; j++) {
+                const sentence = skillDenyInertSentence(agentSkills[j]);
+                if (sentence !== undefined)
+                    return { layer: "agents.skills", message: `agents[${i}]: skills[${j}]: ${sentence}` };
+            }
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=rule-entry-list.js.map

package/dist/rules-consent.js

@@ -89,6 +89,9 @@ function isSupportedRuleMatch(match) {
         case "subpath":
         case "path":
             return false;
+        case "name":
+        case "name_prefix":
+            return false;
         default: {
             const unknown = match;
             void unknown;

package/dist/run-local.d.ts

@@ -132,7 +132,7 @@ export interface LocalApproverIo {
  * 🔴 S-694 起本席也服**三张审批名单**产的 ask(审批基线取 live 席,见 {@link RUN_LOCAL_APPROVAL_SEAT}):
  * `APPROVAL_REQUIRE` / `APPROVAL_NEVER_AUTO` 命中 ⇒ 策略 `ask` ⇒ 落到这里。`AskRequest` 不带是哪条声明产的
  * ask(core 把 `matchedAskRule` 刻意留在闸内、不上请求),但带这一问的**类**(`classes`,core 7.37.0 起)。
- * 🔴 无 TTY 拒句的出路**按这一问的类说话**({@link NO_TTY_ASK_CLASS_ROW} 一张闭集表:每类 ⇒ 一种出路):没人表态的服务器工具调用指 `APPROVAL_GRANT`,
+ * 🔴 无 TTY 拒句的出路**按这一问的类说话**({@link NO_TTY_ASK_CLASS_ROW} 一张闭集表:每类 ⇒ 一种出路):普通问与没人表态的服务器工具调用指 `APPROVAL_GRANT`(allow 层的部署成员清的就是这两类),
  * 写下的 ask 名单指名单旋钮(`APPROVAL_DENY` 也点名 —— 它当场拒、不经本席),部署强制要人答的问(`operator_forced`)列「one of」能铸它的来源、shell 地板(`shell_floor`)另一句只列铸它的旋钮,其余各类**不点任何旋钮**、只说去终端答;
  * 类缺席 ⇒ 说实话(「引擎没有说明这一问的类」),不回落成全量旋钮清单(那句对多数类是错的出路)。
  *
@@ -161,7 +161,9 @@ type NoTtyRemedy = NoTtySpokenRemedy | "terminal_only";
 /**
  * 一类问 ⇒ 这条腿上它的出路。**穷尽表**:core 的 `ASK_CLASSES` 加一类 ⇒ 这里 tsc 红(`Record<AskClass, …>` 少一键),新类必须在这里表态,
  * 不会悄悄落成「没有出路」。本仓知道而 core 不知道的只有一件:**哪只部署旋钮会产哪一类问**(逐类的产地见各行):
- *  · `unstated`:没有任何层表态的服务器工具调用(core 7.40.0)—— 运维为自己接的服务器表态的地方是 `APPROVAL_GRANT`(`run-local` 没有请求体,写不了 `settings.permissions.allow`);
+ *  · `unstated`:没有任何层表态的服务器工具调用(core 7.40.0)—— 运维写一次的地方是 `APPROVAL_GRANT`(`run-local` 没有请求体,写不了 `settings.permissions.allow`;
+ *    7.117.0 / core 7.42.0 起它是 allow 层的部署成员,经部署姿态座席族落在本腿的每只 Runner 上);
+ *  · `ordinary`:普通问(内置工具的写门、shell 的普通检查等)—— 7.117.0 起同样由 `APPROVAL_GRANT` 清(allow 层只清这两类),出路同上;
  *  · `ask_rule`:写下的 ask 规则 —— `APPROVAL_REQUIRE` / `APPROVAL_NEVER_AUTO`(`operatorAsk`)与治理层的 commandPolicy ask 名单(同一只铸点);请求体的
  *    `settings.permissions.ask` 到不了这条腿(本文件不 import 任何请求受理 / `task-settings`,`run-local` 的 spec 自铸);
  *  · `operator_forced`:部署**强制**要人答的问 —— 能铸它的来源(真 Runner × `applyLocalGovernance` 亲读类集,读数在 `test/run-local.test.ts` S-1100 ⑨ 各格):`APPROVAL_NEVER_AUTO`

package/dist/run-local.js

@@ -146,6 +146,7 @@ export const NO_TTY_ASK_CLASS_ROW = {
     rule_unreadable: { remedy: "terminal_only", autoBudgetReleases: false },
     ask_rule: { remedy: "approval_lists", autoBudgetReleases: true },
     denial_limit_fallback: { remedy: "terminal_only", autoBudgetReleases: false },
+    classifier_no_ruling: { remedy: "terminal_only", autoBudgetReleases: false },
     operator_forced: { remedy: "deployment_mandate", autoBudgetReleases: false },
     shell_floor: { remedy: "shell_gate", autoBudgetReleases: false },
     write_protection_unresolved: { remedy: "terminal_only", autoBudgetReleases: false },
@@ -157,12 +158,12 @@ export const NO_TTY_ASK_CLASS_ROW = {
     artifact_shared_read: { remedy: "terminal_only", autoBudgetReleases: false },
     mode: { remedy: "terminal_only", autoBudgetReleases: false },
     unstated: { remedy: "grant", autoBudgetReleases: false },
-    ordinary: { remedy: "terminal_only", autoBudgetReleases: false },
+    ordinary: { remedy: "grant", autoBudgetReleases: false },
     requires_user_interaction: { remedy: "terminal_only", autoBudgetReleases: false },
 };
 const NO_TTY_REMEDY_SENTENCE = {
-    grant: () => `No rule, policy or hook granted this server tool and it states no permission of its own: the operator states one with APPROVAL_GRANT ` +
-        `(an allow rule for server tools — an exact tool name, mcp__<server>__* or a2a__<peer>__*).`,
+    grant: () => `Nothing on the allow layer covers this call: the operator can clear this kind of question once with APPROVAL_GRANT ` +
+        `(a tool name, mcp__<server>__* / a2a__<peer>__*, Bash(<prefix>:*), or Read(//<dir>/**)).`,
     approval_lists: (budget) => `The gate comes from the approval lists: APPROVAL_REQUIRE / APPROVAL_NEVER_AUTO (APPROVAL_DENY refuses outright without asking); ` +
         `a separate .env for this CLI keeps a server's lists off it.` +
         (budget ? ` APPROVAL_AUTO_BUDGET auto-approves that many APPROVAL_REQUIRE calls.` : ""),

package/dist/runs.d.ts

@@ -316,7 +316,7 @@ pendingEngineNotices?: readonly {
 trustedInternals?: Pick<RunInternals, "workflowParkedResume">, 
 /**
  * S-928 用户输入受理账本(`src/user-input-ledger.ts`;路由层 `deps.userInputLedger`)。两手:开通告口那一拍(模型调用之前)把本会话
- * 已收敛、未告知的崩溃丢失铸成 `task.user_steer_undrained{cause:"crashed"}`;腿收场时把本腿上的 steer 受理 settle 掉。
+ * 已收敛、未告知的崩溃丢失铸成 `task.user_steer_undrained` / `task.user_followup_undrained`(`cause:"crashed"`,码按受理时的车道选);腿收场时把本腿上的受理 settle 掉。
  * 缺席 ⇒ 两手都不做(与本参数存在之前逐字相同)。
  */
 userInputLedger?: UserInputLedger): Promise<void>;

package/dist/runs.js

@@ -82,6 +82,7 @@ const PREPARE_REFUSAL_HTTP_STATUS = {
     "config.invalid_checkpoint_store": 400,
     "config.skill_listing_budget_invalid": 400,
     "config.user_invoked_skill_unknown": 400,
+    "config.image_invalid": 400,
     "config.memory_capture_unsupported": 409,
 };
 export function resumeAtHttpStatus(result) {

package/dist/runtime-governance.d.ts

@@ -26,6 +26,7 @@
 import { type ShellGateDoctrine, type TaskSpec, type ToolPolicy } from "@sema-agent/core";
 import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
+import { type GovernanceOverrides } from "./governance-overrides.js";
 /** 运维 autonomy 四档的**闭集**(同上)。`config.ts` 的 `parseAutonomy` 也从这里读 —— 四档词表全仓一份。 */
 export declare const AUTONOMY_MODES: ["read-only", "ask", "plan", "auto"];
 /** A per-command governance rule (registry `runtime.commandPolicy[]`) —— **型也从契约派生**:
@@ -97,19 +98,6 @@ export declare function validateCommandRules(rules: CommandRule[]): string[];
  * 闭集本身则由契约 zod 派生 ⇒ 契约加一个判词,`RANK` 与桶分配的穷尽 switch 双双**编译红**。
  */
 export declare function compileCommandPolicyLayers(rules: CommandRule[] | undefined): ToolPolicy[];
-/** 运维 allow 规则表的出处名 = 它的 env 名(盖进每条规则;编不出来 / 不合文法时拒启句的主语)。 */
-export declare const APPROVAL_GRANT_SOURCE = "APPROVAL_GRANT";
-/**
- * 7.115.0 —— 运维的 allow 规则(`APPROVAL_GRANT`)编成治理层的**叶**(空 / 缺席 ⇒ `[]`,本层一片叶都不铸,折叠逐字与修前同)。
- *
- * 编译口是**请求腿 `settings.permissions.allow` 的同一只**(`permission-rule-list.ts` `createRuleListPolicy`,`behavior: "allow"`):命中 = core 带
- * `decisionReason: "rule"` 的放行(折叠把这句表态带到终局,引擎据此不再为没人表态的服务器工具调用出 `unstated` 卡);未命中 = 裸 allow =
- * 不表态。它是一片**不收紧**的叶 —— 与 commandPolicy / 守卫集同住一个折叠点,只因为三者是同一个「部署说的话」:折叠 deny > ask > allow,
- * 同折叠里任何一片叶的 deny / ask、`tightenTaskSpec` 之下的审批基线、之上的请求 settings 与会话规则,照旧压过它。
- *
- * 启动校验(`config.ts` `approvalGrantRefusal`)试编的也是本函数 —— 拒启判据与运行期编译是同一只,不会出现「启动收下、任务里编不出来」。
- */
-export declare function compileApprovalGrantLayers(grant: readonly string[] | undefined): ToolPolicy[];
 /**
  * Expand an autonomy mode into TIGHTEN-ONLY `TaskSpec` safety overrides (the primitives — TRAP #2):
  *  - `read-only` / `plan` → `handsReadOnly: true` **+ `writeFace: "roots"`** (read + propose, never mutate; the
@@ -133,7 +121,7 @@ export declare function compileApprovalGrantLayers(grant: readonly string[] | un
  * 与 `ask → shellGate:"always"` 同姿势:这一档**自己就是**一次「围栏在」的表态,所以无表态的请求上
  * 它照样把键写出来(不是「只在有 open 时才压」——那又是一条判据)。
  */
-export declare function autonomyOverrides(autonomy: Autonomy | undefined): Partial<TaskSpec>;
+export declare function autonomyOverrides(autonomy: Autonomy | undefined): GovernanceOverrides;
 /**
  * [ref]:**部署级**判据 —— 本部署的治理层自己是否把 shellGate 抬到 `"always"`。
  *
@@ -216,17 +204,15 @@ export declare function governanceOriginOf(gate: {
     };
 } | undefined, governance: GovernancePosture | undefined): true | undefined;
 /**
- * Apply the operator's runtime governance (autonomy + commandPolicy + manualModeShellGate + the guard set + the
- * `APPROVAL_GRANT` allow rules) onto a base
+ * Apply the operator's runtime governance (autonomy + commandPolicy + manualModeShellGate + the guard set) onto a base
  * `TaskSpec`, TIGHTEN-ONLY, in a SINGLE {@link tightenTaskSpec} call: commandPolicy compiles to a `toolPolicy`
  * override (combined onto the baseline by `tightenTaskSpec` — TRAP #1), and autonomy expands to
  * `handsReadOnly` / `shellGate` overrides (TRAP #2). `tightenTaskSpec` THROWS `TaskSpecTightenError` if any
  * override would LOOSEN a stricter base safety field — surfacing a misconfiguration loudly instead of silently
  * weakening the gate. Returns `base` untouched when there is nothing to apply.
  *
- * 7.115.0:`APPROVAL_GRANT` 是这里唯一一片**不收紧**的叶 —— 它只给出 allow 的那句表态(core 7.40.0 起没人表态的服务器工具调用要问,
- * 运维的规则就是那句答),从不清掉任何 deny / ask:折叠 deny > ask > allow,所以「部署 ⊇ 操作员 ⊇ 客户端只能收窄」的不变量逐字成立。
- * 编译口与请求腿的 allow 桶同一只({@link compileApprovalGrantLayers})。
+ * 7.117.0(core 7.42.0):运维的 allow 表 `APPROVAL_GRANT` 不再是这里的一片叶 —— 策略只说 deny / ask,allow 规则住在引擎 allow 层的部署席
+ * `RunnerDeps.allowedTools`(`boot/runner-deps.ts` 的部署姿态座席族,每只 Runner 同一席)。本函数因此只剩收紧。
  *
  * [ref]([ref] server 分单②):`MANUAL_MODE_SHELL_GATE` 从 settings 折叠搬到这里**无条件施加**。旧家
  * (task-settings deriveSettingsPolicy 的 default/auto/acceptEdits 三臂)让一个**部署级 tighten-only 旋钮
@@ -260,8 +246,6 @@ export declare function applyRuntimeGovernance(base: TaskSpec, governance: {
     /** 守卫集的**叶**(`deployment-governance.ts` `createDeploymentGovernanceInputs` 预铸;S-958 起是叶的列表,不是一只预折的策略)。
      *  空列表与缺席同义。 */
     sensitivePathLayers?: readonly ToolPolicy[];
-    /** 7.115.0:运维的 allow 规则(`APPROVAL_GRANT` 原串;本函数经 {@link compileApprovalGrantLayers} 编成叶)。空列表与缺席同义。 */
-    approvalGrant?: readonly string[];
     /** [ref]/[ref] `governanceForced` 的标记表(缺省 = **当前 run 腿的 ALS 表**,见
      *  `governance-ask-marks.ts` 顶注「作用域」段)。注入口只为测试与将来的多实例形。 */
     askMarks?: GovernanceAskMarks;