@sema-agent/server 7.116.1 → 7.118.0

package/dist/runtime-governance.js

@@ -1,8 +1,8 @@
-import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, wrapToolPolicy, } from "@sema-agent/core";
+import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, wrapToolPolicy, } from "@sema-agent/core";
 import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
+import { tightenGoverned } from "./governance-overrides.js";
 import { createDeploymentAuthoredPolicy, operatorAsk } from "./operator-ask.js";
-import { createRuleListPolicy } from "./permission-rule-list.js";
 import { heldRuleName } from "./tool-rule-names.js";
 const COMMAND_RULE_SHAPE = GovernanceConfig.shape.commandPolicy.unwrap().element.shape;
 const COMMAND_DECISIONS = COMMAND_RULE_SHAPE.decision.options;
@@ -101,10 +101,6 @@ export function compileCommandPolicyLayers(rules) {
     }
     return policies;
 }
-export const APPROVAL_GRANT_SOURCE = "APPROVAL_GRANT";
-export function compileApprovalGrantLayers(grant) {
-    return grant !== undefined && grant.length > 0 ? [createRuleListPolicy(grant, "allow", APPROVAL_GRANT_SOURCE, undefined)] : [];
-}
 export function autonomyOverrides(autonomy) {
     switch (autonomy) {
         case "read-only":
@@ -148,7 +144,7 @@ function createGovernanceShellGateMarkPolicy(marksOf, tools = COARSE_SHELL_TOOLS
 export function applyRuntimeGovernance(base, governance) {
     const marksOf = () => governance.askMarks ?? currentGovernanceAskMarks();
     const overrides = { ...autonomyOverrides(governance.autonomy) };
-    const layers = [...compileCommandPolicyLayers(governance.commandPolicy), ...(governance.sensitivePathLayers ?? []), ...compileApprovalGrantLayers(governance.approvalGrant)];
+    const layers = [...compileCommandPolicyLayers(governance.commandPolicy), ...(governance.sensitivePathLayers ?? [])];
     const governancePolicy = layers.length > 0 ? createGovernanceAskMarkingPolicy(combinePolicies(...layers.map(createDeploymentAuthoredPolicy)), marksOf) : undefined;
     if (governancePolicy !== undefined)
         overrides.toolPolicy = governancePolicy;
@@ -161,6 +157,6 @@ export function applyRuntimeGovernance(base, governance) {
     if (Object.keys(overrides).length === 0) {
         return base;
     }
-    return tightenTaskSpec(base, overrides);
+    return tightenGoverned(base, overrides);
 }
 //# sourceMappingURL=runtime-governance.js.map

package/dist/session-policy-wire.d.ts

@@ -29,12 +29,13 @@
  * 里同点同调它;准备阶段的名审计与本仓配置表读的是同一只 `judgeRuleToolName`)—— 本仓手写的那一只(`legacyToolNameOf`)删除,零双读;
  * 「哪几桶装工具名」归 core(它的 `HOLDS_TOOL_NAMES`)。
  *
- * ── 7.116.0:写口读者再多判一问 —— 够不着挂载工具的协议名 ─────────────────────────────────────
- * 缺段(`mcp__srv__` / `mcp__`)与对端段铸不出(`mcp__github.com__*`)的协议名 core 的判官判 `current`(它只看退役名与无前缀 `__` 名),
- * 而配置表一直拒缺段名 —— 一个名字两张表两种答案,对端段那一半则两张表都照收、永不命中。判官与句子是 `namespaced-rule-name.ts` 的那一只
- * (配置表同调),码 `400 request.field_invalid`(会话规则写口既有的字段值码;不另铸新码,也不往 core 的判词闭集里塞本仓的词)。
- * 这一问要逐桶判,而 core 不导出 `HOLDS_TOOL_NAMES` 的运行期值 ⇒ 桶表 {@link TOOL_NAME_FIELDS} 的键集从 core 判官交回的 `field` 型派生(两向 tsc 配对),
- * 随这一问在 core 自己给出判词那天整只退役。SQL 店写口经 {@link assertSessionRuleNamesReachable} 同判。
+ * ── 7.116.0:写口读者再多判一问 —— 够不着挂载工具的协议名;7.118.0 收窄到引擎读不到的那一形 ─────────────────────────
+ * 对端段铸不出 / 对端段为空(`mcp__github.com__*`、`mcp__`)自 core 7.43.0 #1355 (b) 起是引擎判官自己的判词 `unmintable_segment` ——
+ * `assertSessionRuleNamesCurrent` 拒(`legacy_tool_name`,`detail.verdict`)、本仓映射 `400 rules.legacy_tool_name`,与退役名同码同句族;本仓 7.116.0 起
+ * 那只自比对端段的对照随之退役。引擎判官放行、却一只工具都够不着的只剩**工具段为空**(`mcp__srv__`):判据与句子是 `namespaced-rule-name.ts` 那一只
+ * (配置表同调),码 `400 request.field_invalid`(会话规则写口既有的字段值码;不往 core 的判词闭集里塞本仓的词)。这一问要逐桶判,而 core 不导出
+ * `HOLDS_TOOL_NAMES` 的运行期值 ⇒ 桶表 {@link TOOL_NAME_FIELDS} 的键集从 core 判官交回的 `field` 型派生(两向 tsc 配对),随引擎判官给这一形判词那天整只退役。
+ * SQL 店写口经 {@link assertSessionRuleNamesReachable} 同判。
  *
  * ── 文案也在这里(codex 一轮追加:两条腿各铸一份句子 = 第二份手抄)───────────────────────────────
  * 初版把 wire 文案留在两个路由各自铸,理由是错误文案冻结门(`test/api-error-text-freeze.test.ts`)锚的是
@@ -45,16 +46,16 @@
  */
 import { SessionPolicyError } from "@sema-agent/core";
 import type { SessionPermissionRules, SessionRuleNameRefusal, SessionRulesRecord } from "@sema-agent/core";
-import { type UnreachableNamespacedRuleName } from "./namespaced-rule-name.js";
+import { emptyToolSegmentOf } from "./namespaced-rule-name.js";
 /** core `SessionPermissionRules` 的桶名全集(派生,不是手抄)。 */
 export declare const SESSION_PERMISSION_RULE_FIELDS: readonly (keyof SessionPermissionRules)[];
-/** 工具名桶里一条够不着任何挂载工具的协议名(缺段 / 对端段铸不出);`verdict` = 判官的判词。 */
+/** 工具名桶里一条引擎判官放行、却一只工具都够不着的协议名(工具段为空);`ns` = 它的协议。 */
 export interface SessionRuleUnreachableName {
     readonly field: SessionRuleNameRefusal["field"];
     readonly name: string;
-    readonly verdict: UnreachableNamespacedRuleName;
+    readonly ns: NonNullable<ReturnType<typeof emptyToolSegmentOf>>;
 }
-/** 逐桶逐条过协议规则名判官;第一条够不着的交回,全部够得着 ⇒ `undefined`。 */
+/** 逐桶逐条问引擎读不到的那一形;第一条交回,全部够得着 ⇒ `undefined`。调用方先过引擎判官({@link legacyToolNameRefusalOf} / `assertSessionRuleNamesCurrent`)。 */
 export declare function unreachableSessionRuleNameOf(rules: SessionPermissionRules): SessionRuleUnreachableName | undefined;
 /**
  * SQL 会话规则店写口的同一问(core 判官之后、收紧门之前,与 `assertSessionRuleNamesCurrent` 同点):够不着 ⇒ 抛,一条写语句都不发。
@@ -80,7 +81,7 @@ export type SessionPermissionRulesProblem = SessionPermissionRulesShapeProblem
     kind: "legacy-tool-name";
     refusal: SessionRuleNameRefusal;
 }
-/** 形对、core 判官也放行,但工具名桶里有一条够不着任何挂载工具的协议名(缺段 / 对端段铸不出)。 */
+/** 形对、core 判官也放行,但工具名桶里有一条一只工具都够不着的协议名(工具段为空 —— 引擎读不到的那一形)。 */
  | {
     kind: "unreachable-tool-name";
     unreachable: SessionRuleUnreachableName;
@@ -109,7 +110,7 @@ export declare function readSessionPermissionRules(raw: unknown): SessionPermiss
  * 面经 {@link readSessionRulesRecords})往会话规则店写之前的**唯一**判据。两问,按序:
  *  ① 形(同 {@link readSessionPermissionRules};一份坏形的体答形的 400);
  *  ② 工具名桶里的每一条过 core 的判官({@link legacyToolNameRefusalOf})—— 写进去就让会话之后每一跑都起不来的名字,在写口拒;
- *  ③ 工具名桶里的每一条过协议规则名判官({@link unreachableSessionRuleNameOf})—— 写进去永远匹配不到任何挂载工具的协议名,在写口拒。
+ *  ③ 工具名桶里的每一条问引擎读不到的那一形({@link unreachableSessionRuleNameOf}:工具段为空的协议名)—— 写进去永远匹配不到任何挂载工具,在写口拒。
  * 🔴 **只在写口,不在读回**:SQL 店读回同一行时只判形(形读者)。一条早先写进去的退役名行(或够不着的协议名行)必须**读得出来** ——
  * 那是运营方清掉它的唯一路径(operator 的 PUT 先读写前快照),也是 core 准备阶段报 `config.legacy_tool_name`
  * 而不是一只 500 `corrupt` 的前提。把判官放进形读者会让读回把它判坏(7.105.0 车QQ 双库套件实抓,修在同批)。

package/dist/session-policy-wire.js

@@ -1,5 +1,5 @@
 import { PROTOCOL_TABLE, SessionPolicyError, assertSessionRuleNamesCurrent, judgeRuleToolName } from "@sema-agent/core";
-import { describeUnreachableNamespacedRuleName, unreachableNamespacedRuleNameOf } from "./namespaced-rule-name.js";
+import { describeEmptyToolSegment, emptyToolSegmentOf, NO_DECLARED_TOOL_NAMES } from "./namespaced-rule-name.js";
 const RULE_FIELDS = {
     toolAllow: true,
     toolDeny: true,
@@ -24,9 +24,9 @@ const TOOL_NAME_FIELDS = Object.values(TOOL_NAME_FIELD_TABLE);
 export function unreachableSessionRuleNameOf(rules) {
     for (const field of TOOL_NAME_FIELDS) {
         for (const name of rules[field] ?? []) {
-            const verdict = unreachableNamespacedRuleNameOf(name);
-            if (verdict !== undefined)
-                return { field, name, verdict };
+            const ns = emptyToolSegmentOf(name);
+            if (ns !== undefined)
+                return { field, name, ns };
         }
     }
     return undefined;
@@ -99,17 +99,22 @@ export function describeSessionPermissionRulesProblem(p) {
     }
 }
 function describeUnreachableSessionRuleName(u) {
-    return `${u.field} names "${u.name}", which can never match a tool (${describeUnreachableNamespacedRuleName(u.verdict)}), so nothing was written`;
+    return `${u.field} names "${u.name}", which can never match a tool (${describeEmptyToolSegment(u.ns)}), so nothing was written`;
 }
 function describeLegacyToolName(r) {
     switch (r.verdict) {
         case "retired": {
-            const v = judgeRuleToolName(r.name, new Set());
+            const v = judgeRuleToolName(r.name, NO_DECLARED_TOOL_NAMES);
             const guidance = v.kind === "retired" ? v.guidance : `renamed "${r.currentName ?? "?"}"`;
             return `${r.field} names "${r.name}", a retired tool name (${guidance}); with that rule in place this session could not start another run, so nothing was written — use the current tool name${r.currentName !== undefined ? ` ("${r.currentName}")` : ""}`;
         }
         case "unprefixed_namespace":
             return `${r.field} names "${r.name}", which contains "__" but no protocol prefix; with that rule in place this session could not start another run, so nothing was written — a protocol tool is named ${protocolToolNameShapes()}`;
+        case "unmintable_segment": {
+            const v = judgeRuleToolName(r.name, NO_DECLARED_TOOL_NAMES);
+            const guidance = v.kind === "unmintable_segment" ? v.guidance : "a protocol name whose peer segment the engine never mints";
+            return `${r.field} names "${r.name}", which can never match a tool (${guidance}), so nothing was written`;
+        }
         default: {
             const unhandled = r.verdict;
             throw new Error(`unhandled legacy tool name verdict: ${JSON.stringify(unhandled)}`);

package/dist/spec-fields.d.ts

@@ -4,7 +4,6 @@
  * body WITHOUT the HTTP-layer 400 validation, so a malformed value must fall back to a safe default, never throw.
  */
 import { type AgentDefinition, type TaskSpec } from "@sema-agent/core";
-import { type UnreachableNamespacedRuleName } from "./namespaced-rule-name.js";
 /**
  * E12 — normalize `body.suggestNextPrompts` → `TaskSpec.suggestNextPrompts`. `true` = on with core defaults
  * (count 3, cheap role); an object tunes `count` (clamped 1..10) / `role` (a free string — core validates it against
@@ -48,31 +47,22 @@ export declare const MAX_TASK_AGENTS = 32;
  * deny 规则来源,不是围栏)的**形**谓词。两道技能门(顶层 `body.skills[]` 的 `validateUserSkills`、`agents[].skills[]` 的
  * {@link SKILL_FIELD_SHAPES})**同一只**:一边判一边不判 = 同一个键两种话(S-377 baseDir 吃过的亏)。
  *
- * 本谓词只判「字符串数组」:引擎 `compileSkillGrant` 直接 `for (const entry of list)` —— 一个裸字符串 `"Bash"` 会被逐字符迭代成
- * `B` / `a` / `s` / `h` 四条(deny 侧 = 意图静默落空,安全轴上的放宽方向)。条目的**文法**不在受理面判:引擎在开跑时对读不出的条目
- * (`*` / 写路径 / 域名)发 `skills.allowed_tool_not_granted`,文法的属主是引擎(directory loader 同样原样抄、不判)。
- * 形对之后两道门再问一问 {@link unreachableSkillToolListEntryOf}(协议名的服务器段铸不出 / 缺段 ⇒ 400)—— 那一问不是文法,是「写得出却永远匹配不到」,
- * 与配置表、会话规则写口同一只判官。
- * 无条数 / 长度帽([ref]:技能面的受理帽整族退役,体积由 8 MiB 请求体上限兜)。
+ * 本谓词只判「字符串数组」(core 7.42.0 起与请求的 `settings.permissions.allow`、运维的 `APPROVAL_GRANT` **同一只**:`rule-entry-list.ts` 的
+ * `ruleEntryListShapeOk`):引擎直接 `for (const entry of list)` —— 一个裸字符串 `"Bash"` 会被逐字符迭代成 `B` / `a` / `s` / `h` 四条
+ * (deny 侧 = 意图静默落空,安全轴上的放宽方向)。条目的**文法与名字**是引擎的读法:允侧读不出的条目(`*` / 写路径 / 域名 / 退役名 …)引擎在开跑时发
+ * `permission.allowed_tool_not_granted`(受众 = 用户);拒侧读成空的条目(文法或名字层)在 `resolveSpec` 拒(提交 400 / 续跑 409,`rule-entry-list.ts` 的
+ * `skillDenyInertEntryOf`,判据 = 引擎的条目读法)。形对之后两道门再问 {@link skillToolListRefusal}(条数帽 + 引擎读不到的那一形 ⇒ 400)。
+ * 条数帽 = 条目表那一只(`rule-entry-list.ts` `allowLayerEntryCountIssue`,准备开销的界;与请求 allow 桶、运维表同一只),
+ * 在 {@link skillToolListRefusal} 里判;无长度帽([ref])。
  */
-export declare const skillToolListOk: (v: unknown) => boolean;
-/** 技能的两只清单(`allowedTools` = allow 规则来源,`disallowedTools` = deny 规则来源;条目的工具名那一段两只同读)。 */
-declare const SKILL_TOOL_LISTS: readonly ["allowedTools", "disallowedTools"];
-/** 技能清单里一条够不着任何挂载工具的协议名条目。 */
-export interface SkillToolListUnreachable {
-    readonly key: (typeof SKILL_TOOL_LISTS)[number];
-    readonly entry: string;
-    readonly verdict: UnreachableNamespacedRuleName;
-}
+export declare const skillToolListOk: (v: unknown) => v is readonly string[];
 /**
- * 一条技能(形已过两道门的字符串数组判)的两只清单里,第一条「协议名写得出、却永远匹配不到」的条目 —— 判官是 `namespaced-rule-name.ts` 那一只
- * (配置表 / 请求三桶 / 会话规则写口同调),条目的工具名那一段经同一只 `ruleEntryToolName` 取(与配置表的规则编译器消费者同读)。都够得着 ⇒ `undefined`。
- * 两处受理口同调:顶层 `skills[]`(`http/admission.ts` 的 `validateUserSkills`)、子代 `agents[].skills[]`({@link validateTaskAgents})。
- * 续跑重放**不问**这一问(两层都是:重放腿不过受理口,存量体照旧原样交给引擎 —— 引擎把它编成一条永不命中的规则,与修前同一种命运,不另开读法)。
+ * 一条技能(形已过两道门的字符串数组判)的两只清单在受理口的拒因 —— 都过 ⇒ `undefined`。两处受理口同调:顶层 `skills[]`
+ * (`http/admission.ts` 的 `validateUserSkills`)、子代 `agents[].skills[]`({@link validateTaskAgents})。两问:条数帽;引擎读不到、却永远匹配不到的
+ * 条目(工具段为空的协议名,`rule-entry-list.ts` 那一份,与配置表、会话规则写口同一只)。退役名 / 对端段铸不出 / 读成空的条目是引擎的读法(见上):
+ * 允侧交引擎通告,拒侧由 `resolveSpec` 拒。
  */
-export declare function unreachableSkillToolListEntryOf(skill: Record<string, unknown>): SkillToolListUnreachable | undefined;
-/** 两处受理口同一句(句子的后半与配置表 / 会话规则写口同一只 `describeUnreachableNamespacedRuleName`)。 */
-export declare function describeUnreachableSkillToolListEntry(u: SkillToolListUnreachable): string;
+export declare function skillToolListRefusal(skill: Record<string, unknown>): string | undefined;
 /** [ref] 单条 agent 定义的形状裁决:null=合法;否则一句可 400 的英文错误(不带索引,调用方自己加)。
  *  白名单外键 fail-loud —— 与 resilience/limits 的「容忍未知键」相反:agents 是能力定义,静默丢字段 =
  *  定义被悄悄削(一个丢掉的 isolation 就是放宽),比 400 更危险,故整条拒。⚠️ 已知残账(core 半场):
@@ -188,5 +178,4 @@ export declare function normalizeApproachNotice(raw: unknown): false | {
  * 全空 ⇒ undefined(spec 不挂 limits 键,byte-compat)。
  */
 export declare function resolveTaskLimits(bodyLimits: unknown, caps: TaskLimitCaps, envTimeoutSec: number, requirePrincipal: boolean | undefined, big: boolean, warn?: (event: string, fields: Record<string, unknown>) => void): TaskSpec["limits"];
-export {};
 //# sourceMappingURL=spec-fields.d.ts.map

package/dist/spec-fields.js

@@ -1,7 +1,7 @@
 import { isThinkingLevel } from "@sema-agent/core";
 import { taskWallClockSec } from "./task-workflow.js";
 import { isValidCwd } from "./task-cwd.js";
-import { describeUnreachableNamespacedRuleName, ruleEntryToolName, unreachableNamespacedRuleNameOf } from "./namespaced-rule-name.js";
+import { allowLayerEntryCountIssue, describeEmptyToolSegmentEntry, emptyToolSegmentEntryOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
 export function normalizeSuggestNextPrompts(v) {
     if (v === true)
         return true;
@@ -66,26 +66,22 @@ const toolList = (v) => Array.isArray(v) &&
     v.length <= MAX_AGENT_TOOLS &&
     v.every((x) => typeof x === "string" && x.length > 0 && x.length <= MAX_AGENT_TOOL_NAME_CHARS);
 const plainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-export const skillToolListOk = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+export const skillToolListOk = ruleEntryListShapeOk;
 const SKILL_TOOL_LISTS = ["allowedTools", "disallowedTools"];
-export function unreachableSkillToolListEntryOf(skill) {
+export function skillToolListRefusal(skill) {
     for (const key of SKILL_TOOL_LISTS) {
         const list = skill[key];
-        if (!Array.isArray(list))
+        if (!ruleEntryListShapeOk(list))
             continue;
-        for (const entry of list) {
-            if (typeof entry !== "string")
-                continue;
-            const verdict = unreachableNamespacedRuleNameOf(ruleEntryToolName(entry));
-            if (verdict !== undefined)
-                return { key, entry, verdict };
-        }
+        const over = allowLayerEntryCountIssue(`skill.${key}`, list);
+        if (over !== undefined)
+            return over.message;
+        const empty = emptyToolSegmentEntryOf(list);
+        if (empty !== undefined)
+            return describeEmptyToolSegmentEntry(`skill.${key}`, empty);
     }
     return undefined;
 }
-export function describeUnreachableSkillToolListEntry(u) {
-    return `skill.${u.key} names "${u.entry}", which can never match a tool (${describeUnreachableNamespacedRuleName(u.verdict)})`;
-}
 const skillFilesOk = (v) => Array.isArray(v) &&
     v.every((f) => plainObject(f) && typeof f.path === "string" && f.path.length > 0 && typeof f.content === "string");
 const SKILL_FIELD_SHAPES = {
@@ -197,9 +193,9 @@ export function validateTaskAgents(v) {
         const skills = v[i].skills;
         if (Array.isArray(skills)) {
             for (let j = 0; j < skills.length; j++) {
-                const unreachable = unreachableSkillToolListEntryOf(skills[j]);
-                if (unreachable !== undefined)
-                    return `agents[${i}]: skills[${j}]: ${describeUnreachableSkillToolListEntry(unreachable)}`;
+                const refusal = skillToolListRefusal(skills[j]);
+                if (refusal !== undefined)
+                    return `agents[${i}]: skills[${j}]: ${refusal}`;
             }
         }
         const name = v[i].name;

package/dist/standing-answer-grant.d.ts

@@ -1,8 +1,20 @@
-/** 读口的入参:任何一种载着「这一问」的形(活的 `AskRequest`、`ToolCallRequest`、待决条目、停驻行的 `tool_approval` 臂)都结构上满足。 */
+/** 读口的入参:任何一种载着「这一问」的形(活的 `AskRequest`、`ToolCallRequest`、停驻行的 `tool_approval` 臂)都结构上满足。 */
 export interface StandingAnswerGrantCarrier {
     readonly toolName?: unknown;
     readonly boundGrantDigest?: unknown;
 }
-/** 这一问的应答是否授予这一次调用之外的东西(读法见文件头注)。 */
+/** 一问的授予绑定(闭集):`none` = 应答只覆盖这一次调用;`bound` = 授予、绑定可读;`unreadable` = 授予、绑定读不出。 */
+export type GrantBinding = {
+    readonly kind: "none";
+} | {
+    readonly kind: "bound";
+    readonly digest: string;
+} | {
+    readonly kind: "unreadable";
+};
+/** 这一问的授予绑定(读法见文件头注)。 */
+export declare function grantBindingOf(carrier: StandingAnswerGrantCarrier): GrantBinding;
+/** 这一问的应答是否授予这一次调用之外的东西(= 绑定不是 `none`)。**按工具名记**的读者(耐久豁免店的读写口、豁免列表)据它不碰这类问:
+ *  它们的键没有绑定这一维,记下 / 代答都会越过绑定。 */
 export declare function answerGrantsBeyondCall(carrier: StandingAnswerGrantCarrier): boolean;
 //# sourceMappingURL=standing-answer-grant.d.ts.map

package/dist/standing-answer-grant.js

@@ -1,5 +1,12 @@
 import { SKILL_TOOL_NAME } from "@sema-agent/core";
+export function grantBindingOf(carrier) {
+    if (Object.hasOwn(carrier, "boundGrantDigest")) {
+        const d = carrier.boundGrantDigest;
+        return typeof d === "string" && d.length > 0 ? { kind: "bound", digest: d } : { kind: "unreadable" };
+    }
+    return carrier.toolName === SKILL_TOOL_NAME ? { kind: "unreadable" } : { kind: "none" };
+}
 export function answerGrantsBeyondCall(carrier) {
-    return Object.hasOwn(carrier, "boundGrantDigest") || carrier.toolName === SKILL_TOOL_NAME;
+    return grantBindingOf(carrier).kind !== "none";
 }
 //# sourceMappingURL=standing-answer-grant.js.map

package/dist/task-settings.d.ts

@@ -12,22 +12,21 @@
  * idempotent (the same tighten), so no special resume handling is needed (mirrors runtime-governance).
  *
  * 🔒 SECURITY INVARIANTS (SDK settings.ts §3.3) —— **scope: the `settings.permissions` channel this module projects, and only it**:
- *  - permissions are folded via `tightenTaskSpec` (deny-wins `combinePolicies`); it THROWS on any override that would
- *    LOOSEN a stricter base safety field. Through THIS channel the client can ADD denies/asks/handsReadOnly on top of the
- *    deployment + operator baseline, never widen it. Its `allow` rules (S-654 (c), 7.115.0) STATE an allow for the tools they name —
- *    the answer core 7.40.0 wants before it runs an MCP / A2A call nobody stated — and never override a deny or an ask
- *    from any layer (deny > ask > allow); a miss has no opinion. They release no ask a layer raises itself: on built-in
- *    tools the engine's own write gate and shell checks still ask (unlike the reference implementation's `permissions.allow`).
- *  - ⚠️ This is NOT a claim about the request as a whole. Since server 7.116.0 (core 7.41.0) a request-carried skill's
- *    `allowedTools` — activated by the model's approved `Skill` card, or named in `userInvokedSkills` — IS an accepted
- *    loosening on a different channel (`skills[]` → `TaskSpec.skills`, never through this module): for the rest of that run
- *    it releases the `unstated` / `ordinary` asks the engine itself raises (including the built-in write gate and the shell's
- *    ordinary asks; same predicate as a persisted allow rule), on hosted / multi-tenant deployments too — no deployment
- *    switch, by ruling. It still clears no deny / ask rule (request or operator), no governance / shell-floor /
- *    write-protection / plan-mode / probe / mandated ask, and opens no write containment. An operator who needs a person
- *    asked for a given tool regardless uses the per-tool knobs: `APPROVAL_REQUIRE` (an ask rule), `APPROVAL_NEVER_AUTO`
- *    (a person, mandated), `MANUAL_MODE_SHELL_GATE=always` (shell). Pinned on the real assembly:
- *    `test/skill-grant-operator-knobs.test.ts`.
+ *  - `deny` / `ask` are folded via `tightenTaskSpec` (deny-wins `combinePolicies`); it THROWS on any override that would
+ *    LOOSEN a stricter base safety field. Through those two buckets the client can only ADD denies / asks / handsReadOnly on
+ *    top of the deployment + operator baseline.
+ *  - `allow` (server 7.117.0, core 7.42.0) is NOT a policy: the list rides WHOLE and verbatim into `TaskSpec.allowedTools`,
+ *    the request member of the engine's ONE allow layer (beside a deployment's `RunnerDeps.allowedTools`, a person's stored
+ *    rows, an active skill's `allowed-tools` and a PreToolUse hook's `allow`), read under one predicate. It IS an accepted
+ *    loosening for this run: an entry clears the `unstated` / `ordinary` questions the engine raises for the calls it covers
+ *    (the built-in write gate and the shell's ordinary asks included), on hosted / multi-tenant deployments too — no
+ *    deployment switch, by ruling (the execution lane is the sandbox; the operator's tools are the per-tool knobs). It clears
+ *    no deny / ask rule (request or operator), no governance / shell-floor / write-protection / plan-mode / probe / mandated
+ *    ask and no PreToolUse hook's ask, and opens no write containment; an entry that matches and cannot clear is disclosed on
+ *    the card (`allowRuleShadowed`). An operator who needs a person asked for a given tool regardless uses the per-tool knobs:
+ *    `APPROVAL_REQUIRE` (an ask rule), `APPROVAL_NEVER_AUTO` (a person, mandated), `MANUAL_MODE_SHELL_GATE=always` (shell).
+ *    A request-carried skill's `allowedTools` is the same member's twin (same grammar, same predicate, same admission judge
+ *    `rule-entry-list.ts`). Pinned on the real assembly: `test/allow-layer-operator-knobs.test.ts`.
  *  - permissionMode(轴B #2 注释保鲜,1.254——[ref]/[ref] 后的真实现):`defaultMode` 收**五**模式
  *    (default | acceptEdits | plan | bypassPermissions | auto),bypass/auto 被 HONOR 为 gate-shape 选择
  *    ——但深层不变量未变:bypass=「不加 ask 门」,恒不越部署基线(tightenTaskSpec deny-wins,基线 deny/
@@ -265,8 +264,9 @@ export interface SettingsPermissionBucketIssue {
 }
 /**
  * 三桶的**唯一**判据(纯函数)。`perms` 不是对象 ⇒ 不判(那一形归「settings.permissions must be an object」那道门);桶缺席 / `null`
- * ⇒ 不判(与 `permissions: null` 的「容器缺席」同一约定)。逐桶按 {@link SETTINGS_PERMISSION_BUCKETS} 的序:不是数组 ⇒ `bad_entry`(无
- * `index`);超帽 ⇒ `over_cap`(先判,拒体有界);首个非串 / 空串项 ⇒ `bad_entry` + 它的下标。全合法 ⇒ `null`。
+ * ⇒ 不判(与 `permissions: null` 的「容器缺席」同一约定)。逐桶按 {@link SETTINGS_PERMISSION_BUCKETS} 的序、按该桶的条目规则:不是数组 ⇒ `bad_entry`
+ * (无 `index`);`rule_policy` 桶超帽 ⇒ `over_cap`(先判,拒体有界)、首个非串 / 空串项 ⇒ `bad_entry` + 它的下标;`allow_layer` 桶首个非串项 ⇒
+ * `bad_entry` + 它的下标(整表判据 = `ruleEntryListShapeOk`),超帽同样 `over_cap`(帽的理由不同,见段头)。全合法 ⇒ `null`。
  */
 export declare function settingsPermissionBucketIssue(perms: unknown): SettingsPermissionBucketIssue | null;
 /** 本 service 真正**消费**的 `settings` 顶层键 —— 闭集。每一个都有消费点:

package/dist/task-settings.js

@@ -1,9 +1,12 @@
-import { combinePolicies, createFsWriteGatePolicy, parseRuleText, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, ruleToolGrammarOf, } from "@sema-agent/core";
+import { combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, ruleToolGrammarOf, } from "@sema-agent/core";
 import { unmatchableToolNamesRefusal } from "./config.js";
 import { MAX_PERMISSION_RULES_PER_LIST, createRuleListPolicy } from "./permission-rule-list.js";
+import { allowLayerEntryCountIssue, describeAllowLayerOverCap, describeEmptyToolSegmentEntry, emptyToolSegmentEntryOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { tightenGoverned } from "./governance-overrides.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 import { heldRuleName } from "./tool-rule-names.js";
+import { policyAskStandingAnswerFacts, standingAnswerDurablyRecordable } from "./tool-approval.js";
 export const PERMISSION_MODE_REQUEST_FACE = {
     default: "request",
     acceptEdits: "request",
@@ -83,15 +86,28 @@ function cleanEnvMap(v) {
 }
 export const SETTINGS_PERMISSION_BUCKETS = ["allow", "deny", "ask"];
 export const SETTINGS_PERMISSION_BUCKET_REFUSALS = ["over_cap", "bad_entry"];
-function bucketIssueMessage(f) {
+const BUCKET_ENTRY_RULE = { allow: "allow_layer", deny: "rule_policy", ask: "rule_policy" };
+function bucketIssueMessage(f, rule) {
     switch (f.reason) {
         case "over_cap":
-            return (`${f.field} has ${f.count} entries — at most ${f.cap} are accepted. Refused rather than truncated: a truncated list silently drops the rules past the cap, ` +
-                `and a dropped deny / ask rule is a tightening that never happened. Merge rules into broader patterns or trim the list`);
+            switch (rule) {
+                case "rule_policy":
+                    return (`${f.field} has ${f.count} entries — at most ${f.cap} are accepted. Refused rather than truncated: a truncated list silently drops the rules past the cap, ` +
+                        `and a dropped deny / ask rule is a tightening that never happened. Merge rules into broader patterns or trim the list`);
+                case "allow_layer":
+                    return describeAllowLayerOverCap(f.field, f.count);
+            }
         case "bad_entry":
-            return f.index === undefined
-                ? `${f.field} must be an array of non-empty rule strings — refused rather than ignored, because an ignored list reads as "in effect" to the caller`
-                : `${f.field}[${f.index}] is not a non-empty rule string — every entry must be one. Refused rather than dropped, because a dropped entry reads as "in effect" to the caller`;
+            switch (rule) {
+                case "rule_policy":
+                    return f.index === undefined
+                        ? `${f.field} must be an array of non-empty rule strings — refused rather than ignored, because an ignored list reads as "in effect" to the caller`
+                        : `${f.field}[${f.index}] is not a non-empty rule string — every entry must be one. Refused rather than dropped, because a dropped entry reads as "in effect" to the caller`;
+                case "allow_layer":
+                    return f.index === undefined
+                        ? `${f.field} must be an array of permission-rule strings — refused rather than ignored, because an ignored list reads as "in effect" to the caller`
+                        : `${f.field}[${f.index}] is not a string — every entry must be a permission-rule string. Refused rather than dropped, because a dropped entry reads as "in effect" to the caller`;
+            }
     }
 }
 export function settingsPermissionBucketIssue(perms) {
@@ -102,18 +118,34 @@ export function settingsPermissionBucketIssue(perms) {
         if (v === undefined || v === null)
             continue;
         const field = `settings.permissions.${bucket}`;
+        const rule = BUCKET_ENTRY_RULE[bucket];
         let fields;
         if (!Array.isArray(v))
             fields = { field, reason: "bad_entry" };
-        else if (v.length > MAX_PERMISSION_RULES_PER_LIST)
-            fields = { field, reason: "over_cap", count: v.length, cap: MAX_PERMISSION_RULES_PER_LIST };
         else {
-            const index = v.findIndex((x) => typeof x !== "string" || x.length === 0);
-            if (index >= 0)
-                fields = { field, reason: "bad_entry", index };
+            switch (rule) {
+                case "rule_policy": {
+                    if (v.length > MAX_PERMISSION_RULES_PER_LIST)
+                        fields = { field, reason: "over_cap", count: v.length, cap: MAX_PERMISSION_RULES_PER_LIST };
+                    else {
+                        const index = v.findIndex((x) => typeof x !== "string" || x.length === 0);
+                        if (index >= 0)
+                            fields = { field, reason: "bad_entry", index };
+                    }
+                    break;
+                }
+                case "allow_layer": {
+                    const over = allowLayerEntryCountIssue(field, v);
+                    if (over !== undefined)
+                        fields = { field, reason: "over_cap", count: over.count, cap: over.cap };
+                    else if (!ruleEntryListShapeOk(v))
+                        fields = { field, reason: "bad_entry", index: v.findIndex((x) => typeof x !== "string") };
+                    break;
+                }
+            }
         }
         if (fields !== undefined)
-            return { message: bucketIssueMessage(fields), fields };
+            return { message: bucketIssueMessage(fields, rule), fields };
     }
     return null;
 }
@@ -265,7 +297,7 @@ export function acceptAppendSystemPrompt(v, warn, packDropsAppend) {
     }
     return v;
 }
-const RULE_SOURCE_BY_BEHAVIOR = { allow: "settings.permissions.allow", ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
+const RULE_SOURCE_BY_BEHAVIOR = { ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
 const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];
 const isWorkflowName = (name) => name === RUN_WORKFLOW_TOOL_NAME;
 function createWorkflowAskPolicy(isExempt) {
@@ -273,7 +305,8 @@ function createWorkflowAskPolicy(isExempt) {
         async check(req) {
             if (heldRuleName(req, isWorkflowName) === undefined)
                 return { action: "allow" };
-            if (isExempt) {
+            const ask = { action: "ask", message: `dynamic workflow "${req.toolName}" requires approval in this permission mode`, decisionReason: "rule" };
+            if (isExempt && standingAnswerDurablyRecordable(policyAskStandingAnswerFacts(req, ask))) {
                 try {
                     if (await isExempt(req.toolName))
                         return { action: "allow", decisionReason: "rule" };
@@ -281,7 +314,7 @@ function createWorkflowAskPolicy(isExempt) {
                 catch {
                 }
             }
-            return { action: "ask", message: `dynamic workflow "${req.toolName}" requires approval in this permission mode`, decisionReason: "rule" };
+            return ask;
         },
         nameSets: [{ ask: WORKFLOW_ASK_NAMES }],
     };
@@ -301,7 +334,6 @@ function rejectUnmatchableSettingsNames(perms, pathBases) {
         for (const [field, names, behavior] of [
             ["permissions.ask", perms.ask, "ask"],
             ["permissions.deny", perms.deny, "deny"],
-            ["permissions.allow", perms.allow, "allow"],
         ]) {
             for (const name of names ?? []) {
                 const parsed = parseRuleText(name, behavior);
@@ -313,30 +345,31 @@ function rejectUnmatchableSettingsNames(perms, pathBases) {
             }
         }
     }
-    for (const [field, names, behavior] of [
-        ["permissions.ask", perms.ask, "ask"],
-        ["permissions.deny", perms.deny, "deny"],
-        ["permissions.allow", perms.allow, "allow"],
-    ]) {
+    const judgments = [
+        ["permissions.ask", perms.ask, { consumer: "rule-policy", behavior: "ask", ...(pathBases !== undefined ? { pathBases } : {}) }],
+        ["permissions.deny", perms.deny, { consumer: "rule-policy", behavior: "deny", ...(pathBases !== undefined ? { pathBases } : {}) }],
+    ];
+    for (const [field, names, judgment] of judgments) {
         if (!names)
             continue;
-        const unmatchable = unmatchableToolNamesRefusal(field, names, { consumer: "rule-policy", behavior, ...(pathBases !== undefined ? { pathBases } : {}) });
+        const unmatchable = unmatchableToolNamesRefusal(field, names, judgment);
         if (unmatchable !== undefined)
             throw new Error(unmatchable.message);
     }
+    const emptyAllow = perms.allow !== undefined ? emptyToolSegmentEntryOf(perms.allow) : undefined;
+    if (emptyAllow !== undefined)
+        throw new Error(describeEmptyToolSegmentEntry("permissions.allow", emptyAllow));
 }
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
     const perms = settings.permissions;
     if (!perms)
         return {};
-    const { allow, deny, ask, defaultMode } = perms;
+    const { deny, ask, defaultMode } = perms;
     const pathBases = gate?.taskRoot !== undefined || gate?.taskHome !== undefined
         ? { ...(gate.taskRoot !== undefined ? { root: gate.taskRoot } : {}), ...(gate.taskHome !== undefined ? { home: gate.taskHome } : {}) }
         : undefined;
     rejectUnmatchableSettingsNames(perms, pathBases);
     const policies = [];
-    if (allow)
-        policies.push(createRuleListPolicy(allow, "allow", RULE_SOURCE_BY_BEHAVIOR.allow, pathBases));
     if (deny)
         policies.push(createRuleListPolicy(deny, "deny", RULE_SOURCE_BY_BEHAVIOR.deny, pathBases));
     if (ask)
@@ -380,15 +413,13 @@ export function applyTaskSettings(base, settings, gate, workflowGate) {
     const { toolPolicy, handsReadOnly, enablePlanMode } = deriveSettingsPolicy(settings, gate, workflowGate);
     let next = base;
     if (toolPolicy !== undefined || handsReadOnly !== undefined) {
-        const overrides = {};
-        if (toolPolicy !== undefined)
-            overrides.toolPolicy = toolPolicy;
-        if (handsReadOnly !== undefined)
-            overrides.handsReadOnly = handsReadOnly;
-        next = tightenTaskSpec(next, overrides);
+        next = tightenGoverned(next, { ...(toolPolicy !== undefined ? { toolPolicy } : {}), ...(handsReadOnly !== undefined ? { handsReadOnly } : {}) });
     }
     if (enablePlanMode)
         next = { ...next, enablePlanMode: true };
+    const allow = settings.permissions?.allow;
+    if (allow !== undefined)
+        next = { ...next, allowedTools: allow };
     if (settings.outputStyle) {
         const appended = next.appendSystemPrompt ? `${next.appendSystemPrompt}\n\n${settings.outputStyle}` : settings.outputStyle;
         next = { ...next, appendSystemPrompt: appended };